EUVD-2026-63470Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default 0.0.0.0 bind plus None-password bypass gives remote unauthenticated low-complexity access (AV:N/AC:L/PR:N/UI:N); arbitrary SQL via stored credentials yields full C/I/A impact within one system (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.
AnalysisAI
Authentication bypass in the dbx-web backend of the dbx database client (all versions prior to 0.5.51) lets unauthenticated network attackers reach protected API routes. When DBX_PASSWORD is unset and no stored password exists, auth_middleware treats a None password_hash as 'allow everything' and forwards every request to the handler chain, while the service listens on 0.0.0.0:4224 by default. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the dbx-web backend be running in the unconfigured state: DBX_PASSWORD is unset AND no password has been stored via setup, so password_hash is None and auth_middleware forwards all requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to dbx 0.5.51, which contains the fix (commit fb919efe0a62869631f49242d1f4fe8d41718c2a, release https://github.com/t8y2/dbx/releases/tag/v0.5.51). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running dbx database client and identify which are running versions prior to 0.5.51, with priority given to systems with database exposure from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today