Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-46619

  CVE-2026-46619: OpenAM MSISDN Authentication Bypass via LDAP Injection

  A missing LDAP filter escape in OpenAM's MSISDN authentication module lets an unauthenticated attacker inject LDAP metacharacters and obtain a valid session as any directory user, no password…

• highCVE-2026-46623

  CVE-2026-46623: OpenAM OAuth2 Module Account Takeover via Unverified Password Change

  A logic flaw in OpenAM's OAuth2 authentication module silently resets any local user's password to their own username after an OAuth2 login, letting an unauthenticated attacker log in as that user…

• highCVE-2026-49229

  CVE-2026-49229: @actual-app/sync-server Insufficient Session Expiration on User Disable

  Disabling an OpenID user in Actual Budget's sync server does not invalidate that user's existing session tokens, letting the disabled account keep accessing budgets and admin functions indefinitely.

• highCVE-2026-54351

  CVE-2026-54351: Budibase Server Mass Assignment via Webhook Trigger

  Any builder on a Budibase instance can hijack another workspace's data by injecting a foreign appId into a public webhook POST body, causing automations to run in the victim's database context.

• criticalCVE-2026-54352

  CVE-2026-54352: @budibase/server Arbitrary File Read via PWA ZIP Symlink

  Any workspace builder on a self-hosted Budibase instance can upload a crafted ZIP file containing a symlink to read any file the server process can open, including the .env file that holds every…

• highCVE-2026-54353

  CVE-2026-54353: @budibase/backend-core SSRF DNS Rebinding Bypass

  Authenticated Budibase users can trick the SSRF blacklist into approving a request that actually connects to an internal host, by using a DNS rebinding hostname that returns a public IP during…

• highCVE-2026-52798

  CVE-2026-52798: Gogs Stored XSS in .ipynb Notebook Preview

  A stored XSS flaw in Gogs lets any user with repository write access embed a javascript: link inside a Jupyter notebook file, which executes arbitrary JavaScript in a viewer's browser when they…

• highCVE-2026-52799

  CVE-2026-52799: Gogs Missing Authorization in Attachment Download

  Gogs serves issue and release attachment files to anyone who knows the UUID, with no check that the requester can actually view the repository the attachment belongs to.

• highCVE-2026-52801

  CVE-2026-52801: Gogs Mirror Settings SSRF and Local Repository Import

  Any authenticated Gogs user can bypass the protection on the New Migration feature by updating a mirrored repository's address to a local filesystem path or internal URL, letting them read any repo…

• highCVE-2026-55173

  CVE-2026-55173: AVideo sanitizeFFmpegCommand OS Command Injection via Ampersand Bypass

  AVideo's incomplete patch for a prior command injection bug still lets an attacker run arbitrary OS commands on the encoder server by slipping a bare '&' shell operator past the sanitizer.

• highCVE-2026-52800

  CVE-2026-52800: Gogs CSRF Leading to Organization Owner Takeover

  A missing CSRF check on Gogs organization team management endpoints lets an attacker hijack an org by tricking a logged-in owner into opening a crafted link.

• highCVE-2026-52805

  CVE-2026-52805: Gogs Migration Redirect Bypass SSRF (Internal Repository Theft)

  Gogs lets any authenticated user steal internal Git repositories by submitting a migration URL that redirects to a private network address, bypassing the hostname blocklist because only the initial…