CVE-2026-42604: Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`
Actual is a local-first personal finance tool. The POST /openid/config endpoint in Actual Budget's sync-server versions <= 26.4.0 exposes the full OpenID Connect configuration—including the OAuth2 clientsecret—to any caller who knows the bootstrap password. The endpoint also lacks authentication and rate limiting, making the bootstrap password brute-forceable. Version 26.5.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Actual Budget sync-serverto a version that resolves this vulnerability.Fixed in 26.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42604?
The severity of CVE-2026-42604 is classified as medium with a CVSS score of 6.9.
How do I fix CVE-2026-42604?
To address CVE-2026-42604, update Actual Budget sync-server to version 26.5.0 or later.
What is the risk associated with CVE-2026-42604?
CVE-2026-42604 poses a risk due to the exposure of sensitive OpenID client secret information through a broken authorization guard.
Which versions of Actual Budget sync-server are affected by CVE-2026-42604?
CVE-2026-42604 affects Actual Budget sync-server versions 26.4.0 and earlier.
What is the nature of the vulnerability in CVE-2026-42604?
CVE-2026-42604 is an OpenID client_secret disclosure vulnerability caused by a lack of proper authorization in the /openid/config endpoint.