Actual Budget CVE-2026-42604

Upgrade Actual Budget sync-server to version 26.5.0, which resolves the issue per the vendor security advisory at https://github.com/actualbudget/actual/security/advisories/GHSA-49v6-pqjq-xw55 and the release notes at https://actualbudget.org/blog/release-26.5.0. If immediate patching is not feasible, restrict network access to the sync-server at the firewall or reverse-proxy layer so that the POST /openid/config endpoint is reachable only from trusted administrative hosts; this eliminates remote brute-force risk but requires infrastructure changes and prevents legitimate remote administration. Additionally, if the sync-server was previously internet-exposed, rotate the OAuth2 client_secret in the connected identity provider immediately, as the secret may have already been exfiltrated without evidence in application logs. Using a long, randomly generated bootstrap password raises the brute-force cost as an interim measure but is not a substitute for patching, since the lack of rate limiting means even strong passwords are eventually vulnerable under sustained attack.