CVE-2026-36537: ThingsBoard Auth Bypass Vulnerability

CVE-2026-36537 Overview

CVE-2026-36537 is an authentication bypass vulnerability in ThingsBoard v4.3.0.1, an open-source Internet of Things (IoT) platform. The flaw resides in the OAuth 2.0 authorization code exchange flow at the /login/oauth2/code/ endpoint. The application improperly trusts user-supplied identity data within the user parameter of the request. A remote, unauthenticated attacker can manipulate the email address in this JSON object to impersonate any existing user. Successful exploitation results in complete account takeover without knowledge of the target's credentials. The weakness is classified under [CWE-290] Authentication Bypass by Spoofing.

Critical Impact
Unauthenticated remote attackers can take over any account on a ThingsBoard v4.3.0.1 instance by injecting a target email into the OAuth callback request.

Affected Products

ThingsBoard v4.3.0.1
ThingsBoard deployments using OAuth 2.0 authorization code login flow
IoT environments exposing the /login/oauth2/code/ endpoint to untrusted networks

Discovery Timeline

2026-06-15 - CVE-2026-36537 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-36537

Vulnerability Analysis

ThingsBoard implements OAuth 2.0 single sign-on (SSO) to authenticate users through external identity providers. During the authorization code exchange, the platform receives a callback at the /login/oauth2/code/ endpoint. The endpoint processes a user parameter containing a JSON object with identity attributes, including the user's email address.

The server uses the supplied email value to resolve the corresponding ThingsBoard account and issue a session. The application performs this lookup without verifying that the identity data originated from the trusted identity provider's signed token. An attacker who can reach the callback endpoint can substitute an arbitrary email belonging to a tenant administrator, system administrator, or any registered user. The platform then issues a valid session for the impersonated account.

Root Cause

The root cause is improper trust of client-controllable identity claims during OAuth callback processing. Identity attributes used for authentication decisions must be extracted from the signed ID token or fetched from the provider's userinfo endpoint using a server-side access token. ThingsBoard v4.3.0.1 instead reads the email from a parameter that the requester can modify, eliminating the cryptographic binding between the identity provider's assertion and the local account lookup.

Attack Vector

Exploitation requires only network access to the ThingsBoard login interface and knowledge of a target user's email address, which is often discoverable through tenant directories or open-source intelligence (OSINT). The attacker initiates an OAuth flow, intercepts or crafts the callback request to /login/oauth2/code/, and replaces the email value inside the user JSON parameter with the victim's address. The server issues an authenticated session bound to the victim's account, granting the attacker full access to dashboards, device telemetry, rule chains, and tenant configuration. A proof-of-concept is published in the GitHub Gist PoC Repository.

Detection Methods for CVE-2026-36537

Indicators of Compromise

Requests to /login/oauth2/code/ containing a user parameter with JSON identity data inconsistent with the originating OAuth provider's token
Successful authentications from IP addresses or user agents that do not match the legitimate user's historical pattern
Multiple OAuth callbacks within a short window referencing different email addresses from the same source IP
Session creation events for privileged tenant or system administrator accounts without a corresponding identity provider login event in upstream IdP logs

Detection Strategies

Correlate ThingsBoard authentication logs with the identity provider's audit trail to identify sessions created without a matching IdP issuance event
Parse web server access logs for POST or GET requests to /login/oauth2/code/ and inspect the user parameter for tampering
Deploy a Web Application Firewall (WAF) rule that flags OAuth callback requests carrying inline user JSON containing an email field
Alert on privileged account logins that occur outside established baselines for geolocation, device, or session timing

Monitoring Recommendations

Forward ThingsBoard application logs and reverse proxy access logs to a centralized SIEM for retention and correlation
Enable verbose OAuth flow logging within ThingsBoard to capture the full parameter set submitted to the callback endpoint
Track session creation rates per source IP and per account to detect mass account takeover attempts

How to Mitigate CVE-2026-36537

Immediate Actions Required

Upgrade ThingsBoard to a fixed version once released by the vendor; monitor the official ThingsBoard release notes for patch availability
Restrict network access to the ThingsBoard login interface using IP allowlists, VPN, or zero-trust network access until a patch is applied
Invalidate all active user sessions and require re-authentication after applying mitigations
Audit tenant administrator and system administrator accounts for unauthorized configuration changes, new API tokens, or new integrations

Patch Information

No vendor advisory or fixed version was referenced in the NVD entry at publication. Operators of ThingsBoard v4.3.0.1 should track the upstream ThingsBoard repository and security announcements for an official fix. Apply the patched build to all production and non-production tenants once available.

Workarounds

Disable OAuth 2.0 login on affected ThingsBoard instances and revert to password-based authentication with multi-factor authentication (MFA) until patched
Place ThingsBoard behind a reverse proxy that strips or validates the user parameter on requests to /login/oauth2/code/
Block external access to the OAuth callback endpoint and route OAuth traffic only through trusted identity provider integrations

bash

# Example NGINX rule to block tampered OAuth callbacks containing inline user JSON
location /login/oauth2/code/ {
    if ($arg_user ~* "email") {
        return 403;
    }
    proxy_pass http://thingsboard_backend;
}