PT-2026-6309 · Unknown · Openslides

Sistason · Published 2026-02-04 · Updated 2026-02-18 · CVE-2026-25519

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.29

Description OpenSlides is a web-based presentation and assembly system. Prior to version 4.2.29, a flaw exists in access control for users synchronized via an external IDP, allowing local logins with a trivial password. Specifically, users can log in using the OpenSlides username of a SAML user and any simple password, as the password is valid for all SAML users. This allows unauthorized access to accounts synced through SAML. The vulnerable component involves the local login form and SAML user authentication.

Recommendations Update to version 4.2.29 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-25519

GHSA-VV4H-8WFC-PF8C

Affected Products

Openslides

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25519.json · Exploit
• https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c · Vendor Advisory
• https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25519 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25519 · Vendor Advisory
• https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29 · Note
• https://github.com/OpenSlides/openslides-auth-service/pull/889 · Note
• https://twitter.com/CVEnew/status/2019182762960498828 · Twitter Post
• https://t.me/cveNotify/152423 · Telegram Post