CVE-2024-28868: Umbraco CMS Authentication Bypass Vulnerability

CVE-2024-28868 Overview

CVE-2024-28868 is a user enumeration vulnerability in Umbraco CMS, an ASP.NET-based content management system. Umbraco 10 versions prior to 10.8.4 expose the native login screen to a flaw that allows unauthenticated attackers to infer whether a given username corresponds to a valid account. The issue is tracked under CWE-204 (Response Discrepancy) and CWE-203 (Observable Discrepancy). Umbraco addressed the issue in version 10.8.5. Operators who cannot upgrade can mitigate exposure by disabling the native login screen and relying exclusively on external login providers.

Critical Impact

Unauthenticated attackers can enumerate valid Umbraco backoffice accounts over the network, enabling targeted credential-based attacks against identified users.

Affected Products

• Umbraco CMS 10.x prior to 10.8.4
• Deployments exposing the native backoffice login screen
• Instances not configured for exclusive external login authentication

Discovery Timeline

• 2024-03-20 - CVE-2024-28868 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28868

Vulnerability Analysis

The vulnerability resides in the password verification path of UmbracoUserManager.CheckPasswordAsync. The method handled requests where the submitted password was null differently than requests with a non-null password against the same user. This observable discrepancy in response behavior allows an attacker to distinguish valid from invalid usernames without needing valid credentials.

The root cause involves [CWE-204] Response Discrepancy and [CWE-203] Observable Discrepancy in authentication logic. The flaw does not grant direct access to accounts or data, but it provides reconnaissance value by confirming the existence of specific accounts in the system.

This information can be weaponized in follow-on attacks such as password spraying, credential stuffing with breach corpora, or targeted phishing against confirmed backoffice users. Impact is limited to confidentiality of account existence; integrity and availability are not directly affected.

Root Cause

The CheckPasswordAsync override in src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs only short-circuited when the user object lacked an identity. When a null password was submitted for a valid identity, the method continued into password verification logic, producing a response path different from the invalid-user path.

Attack Vector

The attack is remote and unauthenticated. An attacker sends crafted authentication requests against the native login endpoint, varying the username and omitting or nulling the password field. By comparing response timing, status, or content between known-invalid and candidate usernames, the attacker enumerates valid accounts.

     /// <inheritdoc />
     public override async Task<bool> CheckPasswordAsync(TUser user, string? password)
     {
-        // we cannot proceed if the user passed in does not have an identity
-        if (user.HasIdentity == false)
+        // we cannot proceed if the user passed in does not have an identity, or if no password is provided.
+        if (user.HasIdentity == false || password is null)
         {
             return false;
         }

Source: Umbraco-CMS commit 7e1d1a1. The patch adds an explicit password is null check so the method returns false immediately, eliminating the differential response.

Detection Methods for CVE-2024-28868

Indicators of Compromise

• Repeated POST requests to the Umbraco backoffice login endpoint from a single source address with varying username values
• Authentication requests containing empty, missing, or null password fields against the native login
• High volume of failed login attempts preceding targeted successful logins against specific usernames

Detection Strategies

• Baseline normal backoffice login traffic and alert on bursts of unique usernames per source IP within short windows
• Inspect web server and application logs for login POSTs lacking the password parameter or submitting null values
• Correlate enumeration-style patterns against subsequent credential-stuffing or password-spray activity targeting the same accounts

Monitoring Recommendations

• Enable verbose authentication logging on the Umbraco backoffice and forward to a centralized log platform
• Add rate limiting and alerting at the reverse proxy or WAF layer for the native login route
• Monitor for scanner user agents and anomalous request cadence against /umbraco login paths

How to Mitigate CVE-2024-28868

Immediate Actions Required

• Upgrade Umbraco 10.x deployments to version 10.8.5 or later as published in the GitHub Security Advisory GHSA-552f-97wf-pmpq
• Audit backoffice user accounts and disable any that are unused or orphaned
• Enforce strong, unique passwords and multi-factor authentication for all backoffice users

Patch Information

Umbraco published the fix in commit 7e1d1a1968000226cd882fff078b122b8d46c44d, included in Umbraco 10.8.5. The patch updates UmbracoUserManager.CheckPasswordAsync to return false when the submitted password is null, equalizing the response path for valid and invalid accounts. Full details are in the Umbraco-CMS commit.

Workarounds

• Disable the native login screen and configure the backoffice to use external login providers exclusively
• Restrict access to the /umbraco backoffice path to trusted networks or VPN clients
• Deploy WAF rules to rate-limit and block login requests with missing or null password parameters

# Example: restrict backoffice path to internal network in nginx
location /umbraco {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://umbraco_backend;
}