EUVD-2026-81101
GHSA-jpmm-hm5g-c8g4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated SSRF (AV:N/AC:L/PR:N/UI:N) chains to unauthenticated credential theft and admin takeover; S:C because the SSRF pivots to a distinct internal service, yielding full C/I/A.
Primary rating from Vendor (Altium).
CVSS VectorVendor: Altium
Lifecycle Timeline
3DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself.
One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.
AnalysisAI
Server-side request forgery in the UnifiedLogin service of on-premises Altium Enterprise Server lets an unauthenticated network attacker force the server to issue outbound HTTP requests to arbitrary destinations, including internal-only services. By targeting an internal configuration endpoint that exposes credential material without authentication (relying solely on the request originating locally), the attacker inherits that trusted locality, steals stored credentials, and uses them to obtain an administrative session, resulting in full compromise of the server and its services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the UnifiedLogin service of an on-premises Altium Enterprise Server; no authentication, no privileges, and no user interaction are needed against a default on-prem deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: apply the vendor-released update for Altium Enterprise Server as documented in Altium's security advisory at https://www.altium.com/platform/security-compliance/security-advisories; because the provided intelligence does not enumerate an exact fixed version, confirm the patched build for your release line with Altium support before closing the finding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all on-premises Altium Enterprise Server instances, isolate them from untrusted networks, and block all outbound traffic from the UnifiedLogin service to internal endpoints; also review server logs for any requests to internal configuration endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Altium Enterprise Server
View allRemote code execution in Altium Enterprise Server (versions prior to 8.1.1) and Altium 365 arises from a path traversal
Unauthenticated file disclosure and arbitrary file read in Altium Enterprise Server prior to 8.1.1 allows any network-re
Arbitrary file write in Altium Enterprise Server ComparisonService allows authenticated workspace users to escape the te
Arbitrary file read in Altium Enterprise Server Collaboration Service (versions prior to 8.1.1) allows an authenticated
Arbitrary file read in Altium Enterprise Server on-premise deployments allows any authenticated low-privilege user to es
Server-side request forgery in the shared GraphQL service of Altium Enterprise Server (prior to 8.1.1) and Altium 365 al
Authenticated path traversal in Altium Enterprise Server (before 8.1.1) and Altium 365 lets a low-privileged user read a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today