CVE-2026-92626: Control iD iDSecure Unauthenticated Denial of Service
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Control iD iDSecureto a version that resolves this vulnerability.Fixed in 4.8.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Control iD iDSecure versions earlier than 4.8.3.0 are affected. The vulnerable endpoint is reachable without authentication, so any affected deployment where an attacker can access the iDSecure API is exposed.
What does an attacker need to do to trigger the denial of service?
No credentials or user interaction are required. An attacker needs network access to the /api/dguardintegration/dguardVersion endpoint while the DGuard integration login state is unset.
How can I determine whether the vulnerable condition exists?
Affected installations may terminate the iDSecure process when the endpoint dereferences an unset DGuard integration login state. Review process termination or exception logs for an unhandled null reference exception associated with this endpoint.