CVE-2026-22603: OpenProject Auth Bypass Vulnerability

CVE-2026-22603 Overview

CVE-2026-22603 affects OpenProject, an open-source web-based project management platform. The vulnerability resides in the unauthenticated password-change endpoint /account/change_password, which lacks the brute-force protections applied to the standard login form. Attackers who can enumerate or guess user IDs can submit unlimited password-change attempts against a target account without triggering lockout or rate-limiting controls. Successful password guessing yields full account takeover and, depending on the victim's role, can enable privilege escalation within the application. The flaw is tracked as [CWE-307: Improper Restriction of Excessive Authentication Attempts]. OpenProject patched the issue in version 16.6.2.

Critical Impact
Unauthenticated attackers can perform unlimited password-guessing attacks against any OpenProject user account, leading to account compromise and potential privilege escalation.

Affected Products

OpenProject versions prior to 16.6.2
All deployments exposing the /account/change_password endpoint to untrusted networks
Self-hosted and cloud OpenProject instances running vulnerable releases

Discovery Timeline

2026-01-10 - CVE-2026-22603 published to NVD
2026-01-14 - Last updated in NVD database

Technical Details for CVE-2026-22603

Vulnerability Analysis

The vulnerability stems from inconsistent application of authentication throttling controls across OpenProject endpoints. The standard login form enforces brute-force safeguards such as failed-attempt counters and account lockout. The /account/change_password endpoint, which also accepts a current password as part of its request, did not inherit those controls.

Because the endpoint is reachable without prior authentication, an attacker only needs a valid user identifier to begin guessing. OpenProject user IDs are sequential integers, making enumeration straightforward. The attacker can iterate through wordlists of common passwords against each identified account at machine speed.

Successful exploitation grants control of the targeted account. Compromise of an administrator or project owner extends impact to project data, member management, and integrated systems. The flaw is classified as [CWE-307].

Root Cause

The root cause is a missing security control on a sensitive endpoint. The password-change handler verified the supplied current password but did not increment failure counters, enforce delays, or lock accounts after repeated incorrect submissions. The login pathway and the password-change pathway therefore offered attackers asymmetric levels of resistance against credential guessing.

Attack Vector

Exploitation requires network access to the OpenProject web interface and no user interaction. The attacker scripts POST requests to /account/change_password containing the target user identifier and candidate passwords. Because no lockout is triggered, the attacker can sustain high-rate guessing until a correct password is found. The fix introduced in OpenProject 16.6.2 applies the same brute-force protections used by the login form. Refer to the GitHub Security Advisory GHSA-93x5-prx9-x239 and the patch commit for technical details.

Detection Methods for CVE-2026-22603

Indicators of Compromise

High volumes of POST requests to /account/change_password from a single source IP or small IP set
Repeated password-change attempts targeting sequential or enumerated user IDs
Successful password-change responses preceded by many failed attempts for the same account
Account login activity from new geolocations or user agents shortly after password-change events

Detection Strategies

Analyze web server and application logs for request-rate anomalies on the /account/change_password path
Correlate failed password-change attempts with subsequent successful authentications to identify takeovers
Alert on enumeration patterns where a single source iterates through ascending user IDs
Compare patterns against [CWE-307] brute-force signatures in your detection rule set

Monitoring Recommendations

Enable verbose authentication logging in OpenProject and forward logs to a central SIEM
Track baseline volumes of password-change requests and alert on deviations
Monitor reverse-proxy and WAF telemetry for repeated 4xx responses against the change-password endpoint
Review audit trails for unexpected role changes following password updates

How to Mitigate CVE-2026-22603

Immediate Actions Required

Upgrade OpenProject to version 16.6.2 or later without delay
If immediate upgrade is not possible, manually apply the upstream patch
Review authentication logs for prior brute-force activity against /account/change_password
Force password resets for accounts showing suspicious password-change attempts

Patch Information

OpenProject released the fix in version 16.6.2. The patch extends the same brute-force throttling used on the login form to the password-change endpoint. Operators who cannot upgrade should backport the commit referenced in the GHSA-93x5-prx9-x239 advisory. The corresponding pull request discussion documents the implementation.

Workarounds

Place OpenProject behind a Web Application Firewall and rate-limit requests to /account/change_password per source IP
Block or challenge requests that exceed a small number of password-change attempts per minute
Restrict access to the OpenProject web interface using VPN or IP allow-listing where feasible
Enforce strong password policies and enable multi-factor authentication to reduce the value of guessed credentials

bash

# Example NGINX rate-limit snippet for the password-change endpoint
limit_req_zone $binary_remote_addr zone=pwchange:10m rate=5r/m;

location = /account/change_password {
    limit_req zone=pwchange burst=3 nodelay;
    proxy_pass http://openproject_upstream;
}