EUVD-2026-40169
GHSA-vq63-9qrm-qv35
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible REST API (AV:N), but requires a foreign payload UUID (AC:H); operator auth needed (PR:L); crosses operation security boundary exposing another operation's secrets (S:C/C:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters.
AnalysisAI
Cross-operation authorization bypass in Mythic C2 framework before 3.4.0.60 exposes encryption keys and C2 profile configurations to authenticated operators from separate operations. Four webhook REST endpoints - c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, and c2profile_sample_message_webhook - fail to verify that a submitted payload UUID belongs to the caller's operation, allowing an operator in Operation A to retrieve the full C2 profile configuration of Operation B by supplying a known UUID. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.0 reflects high complexity due to the prerequisite of obtaining a cross-operation UUID.
Technical ContextAI
Mythic is an open-source post-exploitation command-and-control framework used by red teams and penetration testers, operating a Django/Python backend exposing REST webhook endpoints for C2 profile management. The root cause is CWE-862 (Missing Authorization): the four affected endpoints accept a payload UUID as input and retrieve associated C2 profile data without confirming that the UUID's parent operation matches the authenticated operator's authorized operation scope. In Mythic's multi-operator, multi-operation model, operations are meant to be siloed; this bypass breaks that isolation. The affected CPE is Mythic versions prior to 3.4.0.60. The fix is confirmed in commit 82648e8241b800a32e1882afc310e7316d98ebaa, which adds payload ownership verification before serving profile data.
RemediationAI
Upgrade Mythic to version 3.4.0.60 or later, which adds payload ownership verification to the four affected webhook endpoints. The patched release is available at https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60. For teams unable to upgrade immediately, the most effective compensating control is restricting Mythic deployments to single-tenant or single-team configurations - eliminating the cross-operation operator scenario entirely eliminates the attack surface. Additionally, auditing operator accounts and minimizing the number of operators with access to shared Mythic instances reduces exposure. Network-level controls (e.g., binding the Mythic API to localhost or a VPN-only interface) limit who can reach these endpoints but do not address the authorization flaw for already-authenticated operators.
Cross-operation information disclosure in Mythic C2 framework versions before 3.4.0.60 allows any authenticated operator
Authorization bypass in Mythic C2 framework before 3.4.0.60 allows authenticated spectator-role users to perform write o
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today