EUVD-2026-72848
GHSA-pmgh-5556-j7qw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SSO login endpoint
-
DeliverySubmit login asserting Admin identity without password
-
ExploitSSO fails to verify credential
-
ExecutionReceive valid admin session
-
ImpactFull platform takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the vulnerable SSO/login component of Digital-Infrastructure v9.6.7; per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no password, and no user interaction needed. The primary limiting factor is exposure: the SSO endpoint must be reachable by the attacker (instances confined to internal networks or behind a VPN/allowlist are not directly exploitable), and the target must be running the affected 9.6.7 SSO component. No special non-default configuration is indicated by the description. |
| Impact | This is a genuine top-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) indicates remote, network-reachable exploitation with no authentication, no user interaction, and low complexity, yielding full confidentiality/integrity/availability compromise; the SSVC framework independently corroborates this with Exploitation=poc, Automatable=yes, and Technical Impact=total. A password-less admin login is directly and reliably weaponizable, and publicly available exploit code exists, so any internet-exposed instance should be treated as urgent by even a small IT team. The main uncertainty is deployment footprint rather than exploitability: EPSS is not provided in the input, and there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed - the risk is currently PoC-driven, not evidence of mass exploitation. CPE and tag metadata are placeholders ('n/a', 'N A'), so automated asset matching will not flag affected systems and defenders must identify Digital-Infrastructure deployments manually. |
| Exploit ScenarioDerived | An attacker reaches the internet-exposed SSO login endpoint of a Digital-Infrastructure 9.6.7 instance and submits a login request asserting the Admin identity without supplying a valid password. Because the SSO component does not verify the credential, the attacker receives a valid authenticated Admin session and gains full control of the platform. A public PoC/writeup lowers the skill barrier and, given SSVC 'automatable: yes', the attack can be scripted against many hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Authentication bypass in the Single-Sign-On (SSO) component of Digital-Infrastructure v9.6.7 lets a remote attacker log in as any account, including Admin, with no password. The flaw stems from improper authentication (CWE-287) in the SSO login path, giving unauthenticated attackers full administrative takeover. Publicly available exploit code/writeup exists, though it is not listed in CISA KEV; SSVC rates exploitation as PoC, automatable, with total technical impact.
RemediationAI
No vendor-released patch version is identified in the available data, so no fixed release can be cited at this time. Until the vendor publishes a fixed build, restrict network exposure of the SSO component: place the application behind a VPN or IP allowlist so the login endpoint is not internet-reachable, and put it behind an authenticating reverse proxy or WAF that enforces its own identity check in front of the vulnerable SSO flow (trade-off: adds an authentication layer and may complicate legitimate SSO redirects). Monitor authentication logs for logins to privileged accounts (especially Admin) that lack a corresponding credential challenge, and rotate/invalidate existing sessions. Consult the researcher writeup (https://github.com/fangtang7/CVE/blob/main/Digital-Infrastructure/sso.md) and monitor the vendor and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-79576) for an official fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the SSO module of Digital-Infrastructure, a self-hosted platform (version 9.6.7). The root cause is CWE-287 (Improper Authentication): the SSO flow fails to actually verify a supplied credential/proof before establishing an authenticated session, so an attacker can assert an arbitrary identity - up to and including the Admin user - and be granted a valid session without any password. This is characteristic of SSO/token-handling flaws where identity assertion is trusted without cryptographic or credential verification. The CPE (cpe:2.3:a:n/a:n/a) is a placeholder and does not correctly identify the vendor/product; the real product is Digital-Infrastructure per the description and the referenced sso.md writeup.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, low-complexity password-less login as Admin grants full account/platform control, so PR:N/UI:N with C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.
Executive ViewAI
Digital-Infrastructure v9.6.7 deployments face immediate risk of complete administrative compromise through an unauthenticated SSO authentication bypass that allows attackers to masquerade as any account-including administrators-without a password. With exploit code publicly available and no vendor patch currently available, this creates an urgent threat to all user accounts, data confidentiality, and system integrity. Organizations running this version require immediate containment measures while awaiting vendor remediation.
Implement network segmentation to restrict Digital-Infrastructure v9.6.7 SSO component access to trusted networks only; deploy Web Application Firewall rules tuned to detect exploitation patterns targeting the SSO authentication endpoint; enable comprehensive audit logging and real-time alerting on all authentication events and failures; restrict direct internet access to affected systems using IP-based filtering; establish continuous security monitoring for indicators of compromise such as unauthorized account creation or privilege escalation; prepare incident response procedures for account takeover scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB