PT-2026-6309 · Unknown · Openslides

Sistason · Publicado 2026-02-04 · Atualizado 2026-02-18 · CVE-2026-25519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.29

Description OpenSlides is a web-based presentation and assembly system. Prior to version 4.2.29, a flaw exists in access control for users synchronized via an external IDP, allowing local logins with a trivial password. Specifically, users can log in using the OpenSlides username of a SAML user and any simple password, as the password is valid for all SAML users. This allows unauthorized access to accounts synced through SAML. The vulnerable component involves the local login form and SAML user authentication.

Recommendations Update to version 4.2.29 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-25519

GHSA-VV4H-8WFC-PF8C

Produtos afetados

Openslides

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25519.json · Exploit
• https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c · Aviso do Fabricante
• https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29 · Nota
• https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee · Correção
• https://github.com/OpenSlides/openslides-auth-service/pull/889 · Nota
• https://twitter.com/CVEnew/status/2019182762960498828 · Publicação no Twitter
• https://t.me/cveNotify/152423 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25519 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25519 · Aviso do Fabricante