CVE-2026-81906: [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks
Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully authenticated for the callback response, with the login recorded and login events dispatched. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Concrete CMSto a version that resolves this vulnerability.Fixed in 9.5.3
Event History
Frequently Asked Questions
Which accounts can be used to exploit this issue?
A deactivated or email-unvalidated account is affected if it already has an existing OAuth binding. The issue occurs when that account completes authentication through the OAuth callback login path.
Does exploitation require an existing authenticated session or user interaction?
The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction. However, the affected account must have an existing OAuth binding.
What is the impact of a successful bypass?
The OAuth callback establishes a fully authenticated session for the callback response despite the account being deactivated or unvalidated. The login is also recorded and login events are dispatched.
What version addresses the issue?
Concrete CMS versions prior to 9.5.3 are affected. Updating to version 9.5.3 or later addresses the affected callback path.