CVE-2026-25519

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25519", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T18:21:42.487Z", "datePublished": "2026-02-04T20:50:33.690Z", "dateUpdated": "2026-02-04T21:09:45.826Z"}, "containers": {"cna": {"title": "OpenSlides has incorrect access control vulnerability in authentication service", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c"}, {"name": "https://github.com/OpenSlides/openslides-auth-service/pull/889", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenSlides/openslides-auth-service/pull/889"}, {"name": "https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee"}, {"name": "https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29"}], "affected": [{"vendor": "OpenSlides", "product": "OpenSlides", "versions": [{"version": "< 4.2.29", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T20:50:33.690Z"}, "descriptions": [{"lang": "en", "value": "OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenSlides username of a SAML user and a trivial password. This password is valid for all SAML users. This issue has been patched in version 4.2.29."}], "source": {"advisory": "GHSA-vv4h-8wfc-pf8c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T21:09:14.695928Z", "id": "CVE-2026-25519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:09:45.826Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T21:09:14.695928Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:09:40.631Z"}}], "cna": {"title": "OpenSlides has incorrect access control vulnerability in authentication service", "source": {"advisory": "GHSA-vv4h-8wfc-pf8c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OpenSlides", "product": "OpenSlides", "versions": [{"status": "affected", "version": "< 4.2.29"}]}], "references": [{"url": "https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c", "name": "https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenSlides/openslides-auth-service/pull/889", "name": "https://github.com/OpenSlides/openslides-auth-service/pull/889", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee", "name": "https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29", "name": "https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenSlides username of a SAML user and a trivial password. This password is valid for all SAML users. This issue has been patched in version 4.2.29."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T20:50:33.690Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25519", "state": "PUBLISHED", "dateUpdated": "2026-02-04T21:09:45.826Z", "dateReserved": "2026-02-02T18:21:42.487Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T20:50:33.690Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "OpenSlides", "vendor": "OpenSlides", "versions": [{"status": "affected", "version": "< 4.2.29"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openslides:openslides:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FFF78A6-AFEC-40E1-92E2-B7ABAD16B9EB", "versionEndExcluding": "4.2.29", "versionStartIncluding": "4.2.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenSlides username of a SAML user and a trivial password. This password is valid for all SAML users. This issue has been patched in version 4.2.29."}, {"lang": "es", "value": "OpenSlides es un sistema de presentaci\u00f3n y asamblea gratuito, basado en web, para gestionar y proyectar la agenda, las mociones y las elecciones de una asamblea. Antes de la versi\u00f3n 4.2.29, OpenSlides soporta inicios de sesi\u00f3n locales con nombre de usuario y contrase\u00f1a o un inicio de sesi\u00f3n \u00fanico (single sign-on) opcionalmente configurable con SAML a trav\u00e9s de un IDP externo. Para los usuarios sincronizados con OpenSlides a trav\u00e9s de un IDP externo, existe un control de acceso incorrecto con respecto al inicio de sesi\u00f3n local de estos usuarios. Los usuarios pueden iniciar sesi\u00f3n exitosamente utilizando el formulario de inicio de sesi\u00f3n local y el nombre de usuario de OpenSlides de un usuario SAML y una contrase\u00f1a trivial. Esta contrase\u00f1a es v\u00e1lida para todos los usuarios SAML. Este problema ha sido parcheado en la versi\u00f3n 4.2.29."}], "id": "CVE-2026-25519", "lastModified": "2026-06-17T10:24:46.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T21:09:14.695928Z", "version": "2.0.3"}}]}, "published": "2026-02-04T21:16:02.693", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/OpenSlides/openslides-auth-service/pull/889"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:12:21.610914+00:00", "value": {"mitigation_remediation": ["Upgrade OpenSlides to version\u202f4.2.29 or later to apply the vendor patch that disables the trivial password for SAML users and enforces proper authentication.", "If an immediate upgrade is not possible, reconfigure the authentication service to disable local logins for users synchronized from an external SAML identity provider until the patch is applied.", "Continuously monitor authentication logs for any successful local login attempts using SAML usernames and verify that these are blocked following remediation."], "summary": {"action": "Patch Now", "impact": "Unauthorized Access via authentication bypass"}, "threat_synthesis": {"affected_systems": "The affected product is OpenSlides, a web\u2011based platform for managing assemblies. All installations running a version earlier than 4.2.29 are vulnerable because the fix was released in the 4.2.29 release. The issue is confined to the authentication module and does not affect other components directly, but any user with SAML credentials can be impersonated.", "description_and_impact": "This vulnerability in OpenSlides' authentication service allows attackers to bypass normal login checks for users synchronized from an external SAML identity provider. By entering any SAML user's username into the local login form and using a trivial password that is valid for all such users, an adversary can authenticate as that user without possessing the correct credentials or the IDP token. The flaw is a classic access\u2011control bypass (CWE\u2011284) that grants unauthorized access to the full capabilities of the target account, including viewing and casting votes, editing agendas, and other privileged functions within the assembly system.", "risk_and_exploitability": "The CVSS score of 8.1 classifies the problem as High severity, and the EPSS score of less than 1\u202f% indicates that, as of now, the probability of observed exploitation is low, although the flaw remains publicly documented. The vulnerability is not listed in CISA\u2019s KEV catalog, reducing the likelihood of large\u2011scale active exploitation, but attackers could still carry out targeted credential\u2011guessing or social\u2011engineering strategies to obtain a valid SAML username. The attack capitalizes on the web login interface and requires no special privileges beyond interacting with the public authentication endpoint."}}}}, "created": "2026-02-05T11:39:42.204810+00:00", "updated": "2026-04-17T23:15:30.809641+00:00", "vendors": ["openslides", "openslides$PRODUCT$openslides"]}