CVE-2026-72561: Peppermint Lab Peppermint - Broken Access Control
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
After ensuring only administrators can access the configuration endpoint, check for any OIDC issuer setting changes and restore the correct issuer to prevent attacker-controlled redirects and credential harvesting.
Peppermint Lab Peppermint (global OIDC/SSO settings) OIDC/SSO issuer configuration = Revert/verify to the legitimate (non-attacker-controlled) identity provider after detecting or preventing changes via the configuration endpoint - Compensating control
Restrict access to the unprotected configuration endpoint that updates global OIDC/SSO issuer settings so only authorized (administrative) users can reach it (e.g., via firewall/ACL/network controls).