Improper Authentication in Rebuild Login Endpoint

Executive Summary

CVE-2026-102248 is an unauthenticated authentication bypass in the REBUILD project's login system. The vulnerability occurs in the /user/login endpoint, where a token from a public sharing endpoint (/s/{shareKey}) can be reused as a login credential. This token, rb.csrfToken, is exposed to unauthenticated users and is accepted by the login endpoint without proper validation, allowing attackers to create an administrator session without a username or password.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access attempts to the /user/login endpoint by monitoring logs for requests using tokens from public share links. Inspect network traffic for repeated failed login attempts or unexpected administrator session creations. Verify if tokens from /s/{shareKey} endpoints are being reused in authentication requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to the system as an administrator. They can access restricted management pages, sensitive data, modify user roles, change system configurations, and perform other privileged actions without authentication. The exploit requires only a valid public share link to extract the token.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates secure access to health information. A breach via this flaw may result in data exposure, violating these regulations and potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to the /s/{shareKey} endpoint to prevent token exposure. Implement strict token validation to ensure tokens are only used for their intended purpose. Remove implicit SYSTEM_USER session creation and enforce proper authentication checks on the /user/login endpoint. Update to a patched version of REBUILD if available.

Useful 0 Not Useful 0