Peppermint CVE-2026-72561

Exploitation requires a valid authenticated session for any Peppermint account, including the lowest-privilege non-administrative user roles - no administrative rights are needed. The platform must have OIDC/SSO configured and in active use; deployments relying solely on local username/password authentication are not subject to the credential-harvesting impact, though the configuration endpoint itself may still be reachable. No user interaction, special network position, or non-default configuration beyond SSO being enabled is required - the CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible, low-complexity exploitation. Exploitation is further limited by the requirement for an initial valid account on the target Peppermint instance; external unauthenticated attackers cannot exploit this directly without first obtaining credentials.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the network-reachable attack surface and the breadth of impact: confidentiality (credential harvesting), integrity (global configuration tampering), and availability (disruption of the legitimate authentication flow). The PR:L metric is key - exploitation requires only a standard authenticated account, not administrative access, making the barrier to exploitation very low in any multi-user deployment. The S:U (Scope Unchanged) designation may technically underrepresent real-world impact, since reconfiguring the IDP affects every user of the platform beyond the attacker's own session, which has characteristics of a scope change. No EPSS score was provided in the input data; this cannot be independently assessed. The vulnerability is not listed in CISA KEV and no POC has been identified, which moderates urgency slightly, but the exploitability is straightforward for any user with a valid account. For organizations running Peppermint with OIDC/SSO, this represents a genuine critical-priority issue due to the potential for mass credential harvesting with minimal attacker privilege.

A low-privilege Peppermint helpdesk agent authenticates normally to the platform and sends a crafted HTTP request to the unprotected OIDC configuration endpoint, specifying an attacker-controlled server as the new OIDC issuer. All subsequent SSO login attempts by other users - including administrators - are transparently redirected to the attacker's identity provider, which captures their credentials before optionally forwarding them to the legitimate IDP to avoid detection. No public exploit code has been identified at time of analysis, but the exploit mechanism requires only knowledge of the API endpoint and a valid session token.