CVE-2026-72561

Published: Ago 11, 2026 Last Modified: Ago 11, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.

284

Improper Access Control

Incomplete
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies: Not Technology-Specific, ICS/OT, Web Based
View CWE Details
https://github.com/Peppermint-Lab/peppermint
https://github.com/Peppermint-Lab/peppermint