CVE-2026-36537: Critical severity ThingsBoard ThingsBoard vulnerability
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform without possessing the target user's credentials. This results in a complete account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Stop accepting or trusting the client-supplied 'user' JSON parameter on /login/oauth2/code. Validate identity server-side using the OAuth provider's assertions (e.g., verify ID token signature and claims) and map accounts based on provider-issued identifiers rather than any email or identity data supplied by the client.
ThingsBoard /login/oauth2/code endpoint trust_user_parameter = false - Configuration
Temporarily disable the OAuth authorization-code login flow (/login/oauth2/code) until an upstream fix or patch is applied to prevent authentication bypass via the 'user' parameter.
ThingsBoard OAuth2 authorization code flow authorization_code_exchange = disabled (temporary) - Compensating control
Deploy WAF/reverse-proxy rules to block or inspect requests to /login/oauth2/code that include a client-supplied 'user' parameter or manipulated email values. Where possible, restrict access to the endpoint to trusted IP ranges or internal networks until the issue is remediated.
- Operational
Assume potential account takeover: review access logs for suspicious activity, revoke active sessions and OAuth tokens for impacted accounts, force password resets and re-authentication for users as appropriate, and rotate any credentials or API keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36537?
CVE-2026-36537 has a critical severity rating of 9.8 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-36537?
To fix CVE-2026-36537, upgrade to the latest version of ThingsBoard that addresses the authentication bypass vulnerability.
What kind of attack can occur due to CVE-2026-36537?
CVE-2026-36537 allows for authentication bypass during the OAuth authorization code exchange, enabling unauthorized access to user accounts.
Which version of ThingsBoard is affected by CVE-2026-36537?
ThingsBoard v4.3.0.1 is the affected version that contains the vulnerability CVE-2026-36537.
What is the impact of CVE-2026-36537 on data confidentiality and integrity?
CVE-2026-36537 can lead to a compromise in data confidentiality, integrity, and availability due to unauthorized access.