La fiche CVE officielle n’est pas encore publiée
Publié d’après l’avis de l’éditeur. Remplacé par la fiche CVE.org / NVD dès sa publication.
VU#166125: Bisheng has authentication bypass vulnerabilities
Résumé
CVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint (POST /user/sso). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verif...
Description d'origine La description telle que publiée par la source (souvent en anglais).
CVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint (POST /user/sso). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or network allowlisting. Furthermore, if the provided username does not exist, the system automatically registers the account. If this newly generated account matches the configured administrative username or is the first user in the system, it is automatically granted super-administrator privileges.
(CERT/CC Vulnerability Notes: VU#166125: Bisheng has authentication bypass vulnerabilities)
Source: CERT/CC Vulnerability Notes NVD
Références
- CERTCC-VULNOTES VU#166125: Bisheng has authentication bypass vulnerabilities