CVE-2026-45274
Received Received - Intake

Authentication Bypass in MyBooks Web Server

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, even though the frontend hides registration controls when the flag is false. An unauthenticated remote attacker can call the endpoint directly and create a valid account on an instance whose administrator disabled public registration. The process_auth_header function in webserver/handlers/base.py also does not verify the account's active flag, so the newly created and unactivated account can authenticate immediately and access user-level API functionality. The bypass defeats the intended account-creation policy and can supply the low-privilege account required by related authorization vulnerabilities. This issue is fixed in version 3.42.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-45274
EUVD
EUVD-2026-62485

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
mybooks mybooks to 3.41.2 (inc)
mybooks mybooks 3.42.0
poxenstudio mybooks to 3.41.2 (inc)
poxenstudio talebook to 3.41.2 (inc)
poxenstudio mybooks 3.42.0
poxenstudio talebook 3.42.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MyBooks (also known as Talebook), an ebook management web server. In versions 3.41.2 and earlier, the registration endpoint does not enforce the ALLOW_REGISTER configuration flag, which is only checked on the frontend. Attackers can bypass this restriction by directly calling the registration API to create accounts even when public registration is disabled. Additionally, the authentication process does not verify if an account is active, allowing newly created accounts to log in immediately and access user-level functionality.

This defeats the intended account-creation policy and could enable related authorization vulnerabilities.

Detection Guidance

Check if the MyBooks server version is 3.41.2 or earlier. Use commands like curl to test the registration endpoint: curl -X POST http://<server>/api/user/sign_up. If the server allows account creation despite ALLOW_REGISTER being false, the system is vulnerable.

Impact Analysis

If you run a vulnerable instance of MyBooks, an unauthenticated attacker could create an account on your system even if you disabled public registration. This allows them to access user-level API functionality, potentially leading to unauthorized data access or further exploitation. The impact depends on your deployment environment and data sensitivity.

Compliance Impact

This vulnerability could lead to unauthorized account creation and access, potentially violating compliance requirements for data protection and access controls. For GDPR, it may impact data integrity and unauthorized access. For HIPAA, it could compromise protected health information access controls. The exact impact depends on the data processed by the affected system.

Mitigation Strategies

Upgrade MyBooks to version 3.42.0 or later. Ensure the ALLOW_REGISTER configuration flag is set correctly and verify that account activation is enforced during authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart