Authentication Bypass in Tugtainer via OIDC Login Endpoint

Executive Summary

Tugtainer is a self-hosted app for automating Docker container updates. This vulnerability allows OIDC authentication to be initiated even when OIDC is explicitly disabled via configuration. While the system correctly reports OIDC as disabled at the /auth/oidc/enabled endpoint, a direct request to /auth/oidc/login bypasses this check and triggers the OIDC login flow anyway.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if requests to /auth/oidc/login return HTTP 302 redirects even when OIDC is disabled. Use curl to test the endpoint: curl -v http://<tugtainer-host>/auth/oidc/login. If OIDC is disabled but you receive a redirect to an OIDC provider, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables users to bypass intended authentication restrictions. If OIDC was disabled to limit access, attackers could still initiate OIDC login flows, potentially gaining unauthorized access to the system. The flaw allows authentication attempts using disabled providers to proceed, creating a security bypass.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Tugtainer to version 1.30.3 or later. Verify the fix by testing the /auth/oidc/login endpoint again. Ensure OIDC is properly disabled by checking the /auth/oidc/enabled endpoint returns false. Review authentication logs for unauthorized access attempts.

Useful 0 Not Useful 0