CVE-2026-86274: projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected component is the Authentication Flow in projeto-siga siga, specifically ExAutenticacaoController.autenticar in ExAutenticacaoController.java. The available information identifies versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 as affected.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the cod/jwt argument processed by the authentication endpoint.
What is the likely impact if exploitation succeeds?
Successful exploitation causes missing authorization, allowing access to information that should be protected by authorization controls. The supplied vector rates confidentiality impact as low and indicates no integrity or availability impact.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used, increasing the likelihood that exposed deployments will be targeted.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of publication.