EUVD-2026-36747
GHSA-cjqr-jj24-mfr6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ThingsBoard OAuth2 login
-
DeliveryInitiate authorization-code exchange
-
ExploitTamper email in user JSON parameter
-
ExecutionServer trusts spoofed identity
-
PersistReceive authenticated session for victim account
-
ImpactFull account takeover
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target ThingsBoard 4.3.0.1 instance has OAuth2/OIDC SSO login enabled and that its /login/oauth2/code/ callback endpoint is network-reachable by the attacker; the attacker must know or guess the email address of an existing account to impersonate (the account must already exist on the platform). Given AV:N/AC:L/PR:N/UI:N, no credentials, no privileges, and no victim interaction are needed once those conditions hold. Limiting factors: deployments that do not use OAuth2 SSO are not affected via this path, non-exposed/internal-only instances reduce reach, and takeover is bounded to already-existing accounts rather than arbitrary account creation. |
| Impact | Signals are partly conflicting and should be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and SSVC (Automatable: yes, Technical Impact: total) both point to a trivially exploitable, high-impact, internet-reachable bug with a public POC - a strong prioritization case for any exposed ThingsBoard 4.3.0.1 instance. Counterbalancing this, EPSS is only 0.23% (14th percentile) and there is no CISA KEV listing, meaning no confirmed active, widespread exploitation yet; the low EPSS reflects narrow real-world telemetry and a niche product footprint rather than low technical severity. Net: treat as high priority where the login endpoint is exposed and OAuth2 SSO is configured, but note this is 'publicly available exploit code exists,' not confirmed in-the-wild exploitation. Data caveat: the CPE ('cpe:2.3:a:n/a:n/a') and EUVD affected-version fields are placeholders, and the 'Microsoft' tag appears to be erroneous metadata - the actual product is ThingsBoard per the description. |
| Exploit ScenarioDerived | An attacker reaches an internet-exposed ThingsBoard 4.3.0.1 login, initiates the OAuth2 flow, and intercepts the authorization-code exchange to the /login/oauth2/code/ endpoint. They edit the email field in the 'user' JSON object to that of a tenant or system administrator and submit it; the platform trusts the value and returns a valid authenticated session, granting full control of that account. A public POC gist demonstrates the technique, and with AV:N/AC:L the attack needs no special skill or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Authentication bypass in ThingsBoard IoT platform v4.3.0.1 lets a remote, unauthenticated attacker take over any account by tampering with the user-supplied 'user' JSON parameter during the OAuth2 authorization-code exchange at /login/oauth2/code/. Because the application trusts the attacker-controlled email in that object, swapping it for a victim's address yields a fully authenticated session with no credentials required. Publicly available exploit code exists (a POC gist), SSVC rates it automatable with total technical impact, but EPSS is low at 0.23% (14th percentile) and it is not on CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is present in the provided data, so upgrade to a specific patched release cannot yet be cited - monitor the ThingsBoard project for a release above 4.3.0.1 addressing CVE-2026-36537. As compensating controls, disable OAuth2/OIDC SSO login if it is not essential (trade-off: forces users back to local/basic credentials and breaks federated login), or restrict network access to the /login/oauth2/code/ endpoint and the admin UI to trusted networks/VPN via reverse-proxy or WAF rules (trade-off: complicates legitimate external SSO and mobile access). Where SSO must stay on, place a proxy/WAF rule that rejects requests supplying a client-controlled 'user' JSON body on the OAuth2 callback and enforce that identity is derived only from the IdP token, and closely monitor authentication logs for logins to privileged accounts from unexpected sources. Consult the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-36537) and the POC gist (https://gist.github.com/KKC73/b9d4efda05693882f1e613c0e0fac78d) to build detection signatures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ThingsBoard is an open-source IoT device-management and telemetry platform whose web login supports OAuth2/OIDC single sign-on. The flaw sits in the server-side handling of the OAuth2 authorization-code redemption endpoint (/login/oauth2/code/), where a JSON 'user' object carrying identity claims (notably the email) is accepted and trusted as-is rather than being bound to the identity provider's cryptographically verified token response. This is a textbook CWE-290 (Authentication Bypass by Spoofing): the platform maps the attacker-asserted email to an existing local account and issues a session, so identity is derived from client-controllable input instead of a validated IdP assertion.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated callback tampering needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); full account takeover yields total confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform without possessing the target user's credentials. This results in a complete account takeover.
Executive ViewAI
ThingsBoard IoT platform v4.3.0.1 contains an unauthenticated account takeover vulnerability in OAuth2 authorization, allowing attackers to assume any user identity without credentials by tampering with email parameters. Publicly available exploit code exists, but the vulnerability is not currently exploited at scale (EPSS 0.2%). Organizations running this version face direct exposure of all user accounts and connected IoT infrastructure to unauthorized access and control.
No vendor-released patch identified at time of analysis. Interim mitigations: disable OAuth2 authentication in favor of native or SSO-based authentication; implement network-level access controls restricting the /login/oauth2/code/ endpoint; deploy real-time monitoring for anomalous account access patterns; maintain detailed audit logs of all authentication attempts with parameter logging; require VPN or IP whitelisting for OAuth2 flows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB