EUVD-2026-72850
GHSA-55qv-ff37-vh3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /cas/login endpoint over network
-
DeliveryCraft malicious POST login request
-
ExploitBypass password verification logic
-
ExecutionObtain authenticated user/admin session
-
ImpactAccess SSO-protected applications
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable sso-master v1.0.0 deployment exposing the CAS /cas/login endpoint; the attacker sends a single crafted POST request to that endpoint to bypass password authentication - no valid credentials, no user interaction, and no special client-side configuration are needed per the CVSS vector (PR:N/UI:N). The primary real-world limiter is not a configuration prerequisite but deployment scarcity: this is a niche v1.0.0 open-source SSO project with no known enterprise footprint, so most environments are simply not running it. |
| Impact | The signals conflict sharply. The vendor/NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) frames this as a maximum-severity, remote, unauthenticated authentication bypass - technically credible for a bypass that lets an attacker log in without a password over the network. However, EPSS is only 0.14% (4th percentile), there is no CISA KEV listing, and no SSVC decision data was supplied, all of which argue against widespread or automated exploitation. The dominant limiting factor is prevalence: 'sso-master v1.0.0' is an obscure GitHub-hosted SSO/CAS project (CPE is literally 'n/a:n/a', versions 'n/a n/a'), not enterprise-deployed software, so despite the perfect CVSS the real-world blast radius is very small. A public GitHub writeup (fangtang7/CVE) documents the crafted POST request, lowering the exploitation skill barrier for anyone who does run this code. Net: a genuine critical-class auth flaw, but low real-world priority because the affected product is niche. The A:H component of the vendor vector is not well-supported by the description (an auth bypass yields access, not inherent availability loss) - verify impact scope with the source. |
| Exploit ScenarioDerived | An attacker reaches the /cas/login endpoint of an internet- or intranet-exposed sso-master v1.0.0 instance and submits a specially crafted POST request that the CAS login flow accepts without validating a password, granting an authenticated session as a targeted (potentially privileged) user. A public GitHub writeup documents the crafted request, so a working exploit path is effectively public. From the resulting session the attacker accesses whatever the impersonated account can reach across SSO-federated applications. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can log into sso-master v1.0.0 without supplying a password by sending a single crafted POST request to the CAS /cas/login endpoint, gaining full application access with high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; vendor-published base 9.8). No valid credentials, user interaction, or special client configuration are required, and the assessment notes no availability impact. Despite the critical score, the practical risk is limited by deployment scarcity - this is a niche v1.0.0 open-source SSO project with no known enterprise footprint - and the low EPSS of 0.14% (4th percentile) reinforces that exposure is narrow; there is no CISA KEV listing and no confirmed public exploit code flagged in the supplied intelligence, although a public GitHub write-up demonstrates the affected endpoint. The signals conflict sharply: a maximum-severity authentication bypass paired with near-floor exploit-prediction and no observed exploitation.
RemediationAI
No vendor-released patch was identified at time of analysis: none of the supplied references (NVD, VulDB, EUVD, or the GitHub write-up) specify a fixed version, and patch data is absent rather than negative, so treat any fix as unconfirmed and verify upstream before assuming remediation exists. Because the flaw is an authentication bypass in the CAS login handler, the strongest immediate control is to remove the attack surface: if sso-master is not actively required, decommission it or migrate to a maintained CAS implementation such as Apereo CAS, which eliminates the vulnerable code path entirely at the cost of integration work and SSO reconfiguration. If it must stay online, restrict reachability of /cas/login using a reverse-proxy or firewall allowlist limited to known identity-provider and administrative source addresses, or place the service behind a VPN/zero-trust gateway - this blocks the crafted POST from untrusted networks but will break legitimate remote user logins from outside the allowlist and requires ongoing maintenance of the address list. As a supplementary control, deploy WAF or ingress rules that reject POSTs to /cas/login lacking a well-formed credential payload, and alert on any request that produces an authenticated session without a corresponding password field; such signature-based filtering can be bypassed by encoding variations and may produce false positives against legitimate clients with unusual parameter formatting. Finally, because the bypass grants high-integrity access, treat any pre-patch exposure as potentially compromised: rotate secrets and session-signing material, invalidate outstanding tickets and sessions, and audit /cas/login access logs for POST requests that resulted in sessions without credential submission, referencing https://github.com/fangtang7/CVE/blob/main/sso-master/sso.md, https://nvd.nist.gov/vuln/detail/CVE-2026-79577, and https://vuldb.com/vuln/399854 for detection guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the /cas/login handler of sso-master, an implementation of the CAS (Central Authentication Service) single sign-on protocol, where /cas/login is the endpoint that normally collects credentials and issues authenticated sessions or service tickets. The assigned CWE-284 (Improper Access Control) points to a root-cause class in which the login handler does not actually enforce the authentication check - the request-processing path appears to accept a POST and complete the authentication flow without verifying that a password credential was supplied and validated, resulting in a session/ticket being issued to an attacker. That maps cleanly onto the assessed vector: PR:N/UI:N confirms the bypass needs no credentials and no victim interaction, while C:H/I:H with A:N indicates the outcome is unauthorized read/write access to application data rather than service disruption. Product identification is weak across sources: the CPE string is cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (no vendor/product mapped), EUVD lists affected versions as "n/a n/a", and the only concrete version anchor is v1.0.0 from the description and the public write-up, so downstream scanners relying on CPE matching will not reliably flag this deployment.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated single-request bypass justifies AV:N/AC:L/PR:N/UI:N with C:H/I:H from account takeover; A:N because an auth bypass grants access, not inherent availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request.
Executive ViewAI
An authentication bypass in the open-source sso-master v1.0.0 identity platform allows an unauthenticated attacker to obtain full application access - including reading and modifying data - by sending a single crafted request to the CAS /cas/login endpoint, with no credentials or user interaction required. Because sso-master is a niche project with no known enterprise footprint, most organizations are unlikely to be running it, and exploit-prediction signals (EPSS ~0.1%) and the absence of any CISA KEV listing suggest broad exposure is currently low. Leadership should care because any team that has deployed this identity component is effectively trusting a gatekeeper that can be fully circumvented, and no vendor fix is available to close the gap.
No vendor-released patch identified at time of analysis. Interim mitigations: block or restrict access to the CAS /cas/login endpoint at the network edge, WAF, or reverse proxy; isolate or decommission affected sso-master v1.0.0 instances; require network-layer authentication such as mTLS or IP allow-listing; monitor and alert on authentication attempts lacking credential submission; rotate credentials, secrets, and session tokens; and validate that downstream systems do not trust tokens issued by the exposed instance while planning migration to a maintained SSO platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB