CVE-2026-55181

{
  "etk_id": "ETK-2026-133",
  "cve_id": "CVE-2026-55181",
  "display_id": "CVE-2026-55181",
  "ghsa_id": "GHSA-rg7c-vpfp-2w43",
  "euvd_id": "EUVD-2026-90192",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OIDC disable-switch bypass in Tugtainer",
  "summary": "Tugtainer versions before 1.30.3 allow the OIDC login flow to be started despite OIDC being configured as disabled. An attacker able to reach the OIDC login endpoint can trigger the configured identity-provider authentication flow while that setting is off.",
  "mitigation": "Upgrade tugtainer to version 1.30.3 or later. Until upgraded, restrict access to the OIDC login endpoint if it is not required.",
  "vendor": "Quenary",
  "product": "tugtainer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.30.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "v1.30.3"
      ],
      "package_name": "tugtainer",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
  "epss_score": 0.006,
  "epss_percentile": 0.4766,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 19.22241885,
  "t0_at": "2026-09-30T16:57:15.306000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T17:58:28.767522+00:00",
      "days": 0.04251691576388889,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:57:15.306000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-09-30T17:58:28.767522+00:00",
      "days": 0.04251691576388889,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:57:15.306000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-06-11T01:47:02+00:00",
      "days": -111.63209844907408,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:57:15.306000+00:00",
      "url": "https://github.com/Quenary/tugtainer/security/advisories/GHSA-rg7c-vpfp-2w43"
    },
    "trigger_signal": {
      "at": "2026-09-30T16:57:15.306000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T16:57:15.306000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55181"
    }
  }
}