CVE-2026-87004: Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferredusername) are then used directly as the userid for the resulting Tugtainer session. This issue has been patched in version 1.31.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tugtainerto a version that resolves this vulnerability.Fixed in 1.31.3
Event History
Frequently Asked Questions
Which deployments are affected?
Self-hosted Tugtainer deployments running versions before 1.31.3 are affected where the OIDC login flow is used. The issue is patched in version 1.31.3.
What does an attacker need to exploit this?
The attacker does not need an existing Tugtainer account or user interaction. Exploitation targets the OIDC login completion flow, which accepts id_token claims without validating the token signature, audience, issuer, or expiration.
What is the potential impact?
An attacker may be able to have email, subject, or preferred username claims used as the user_id for a Tugtainer session. This can lead to unauthorized access as a user represented by attacker-controlled claims.
What should be done if immediate patching is not possible?
The provided information identifies the vulnerable component as the OIDC login flow. If immediate upgrade is not possible, restricting or disabling use of that flow is the available mitigation indicated by the affected path.