CVE-2026-86274
Received Received - Intake

Authentication Bypass in Projeto-SIGA via JWT Manipulation

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86274
EUVD
EUVD-2026-72259

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
projeto-siga siga to 11.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an access-code validation bypass in the SIGA system. It allows unauthorized access to restricted documents by exploiting a flaw in the public document-authentication flow. The system issues a signed download JWT for a restricted document if any non-empty access code is provided, without validating it against the document's external-access token. The controller only checks if the access code is present but does not verify its correctness.

Detection Guidance

Check SIGA system logs for requests to /public/app/arquivoAutenticado_stream with non-empty access codes that bypass authorization. Monitor for unusual document downloads or JWT issuance without proper validation.

Impact Analysis

An attacker can exploit this to retrieve restricted document content and metadata by submitting a document reference with an invalid but non-empty access code and a valid reCAPTCHA response. The server returns a signed JWT, which can then be used to directly request the document, bypassing access control. This allows anyone with a document authentication or reference number to access unauthorized information.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive information, violating data protection requirements under GDPR and HIPAA. It allows access to restricted documents without proper authorization, potentially exposing personal or confidential data, which may result in non-compliance with privacy regulations.

Mitigation Strategies

Temporarily disable external document access or restrict /public/app/arquivoAutenticado_stream endpoint. Validate access codes before JWT issuance and revalidate document authorization in the stream endpoint. Remove JWT issuance for unauthorized requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart