Authentication bypass and account takeover in ThingsBoard (CVE-2026-36537)

ThingsBoard improperly trusts user-supplied identity data in the `user` parameter of the `/login/oauth2/code/` OAuth 2.0 authorization code exchange endpoint. A remote attacker can manipulate the email address in this parameter to authenticate as any existing user without possessing their credentials. This results in a complete account takeover. Affected versions: - ThingsBoard v4.3.0.1 and potentially earlier versions We recommend updating to: ThingsBoard v4.2.2.1, ThingsBoard v4.3.1.1. CVSS 9.8 · our assessment: act_now Reference: https://gist.github.com/KKC73/b9d4efda05693882f1e613c0e0fac78d Details: https://vuln.today/cve/CVE-2026-36537