CVE-2026-40810: Userinfo Endpoint SQLi Vulnerability

CVE-2026-40810 Overview

CVE-2026-40810 is an unauthenticated SQL injection vulnerability in the userinfo endpoint of an affected product. The flaw stems from improper neutralization of special elements within a SQL SELECT statement [CWE-89]. Remote attackers can submit crafted input to the endpoint without prior authentication and extract database contents. The advisory describes the impact as a total loss of confidentiality. CERT-VDE coordinated the disclosure and published the vendor advisory tracked as VDE-2026-044.

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents from the userinfo endpoint, resulting in total loss of confidentiality.

Affected Products

• Specific affected products are detailed in the CERT-VDE Security Advisory VDE-2026-044
• Affected product details were not enumerated in the NVD entry at publication
• Refer to vendor advisory for affected version ranges

Discovery Timeline

• 2026-05-27 - CVE CVE-2026-40810 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-40810

Vulnerability Analysis

The vulnerability resides in the userinfo endpoint, which constructs SQL SELECT statements using attacker-controlled input without proper sanitization. An unauthenticated remote attacker can inject SQL syntax into request parameters processed by this endpoint. Injected payloads execute within the database context used by the application. The attacker can read arbitrary records, including authentication material and other sensitive data stored in the backend.

The scope of the impact is limited to confidentiality. The CVSS vector indicates no impact to integrity or availability, meaning the issue enables data disclosure rather than modification or service disruption. Because authentication is not required and the attack is network-reachable, exploitation does not depend on prior access or user interaction.

The EPSS probability at publication was 0.049%, reflecting low observed exploit activity at the time of disclosure. This metric can change as proof-of-concept code or active exploitation emerges.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The userinfo endpoint concatenates or interpolates request data into a SQL SELECT query rather than using parameterized statements or strict input validation. Characters such as single quotes, comments, and statement terminators are passed through to the SQL parser, allowing attackers to alter query semantics.

Attack Vector

An attacker sends a crafted HTTP request to the userinfo endpoint over the network. The request includes SQL metacharacters or UNION-based payloads in parameters consumed by the vulnerable query. The database server processes the modified query and returns rows controlled by the attacker. No credentials, tokens, or user interaction are required to perform the request.

The vulnerability manifests in the userinfo endpoint's query construction logic. Refer to the CERT-VDE Security Advisory VDE-2026-044 for technical details on affected request parameters and exploitation conditions.

Detection Methods for CVE-2026-40810

Indicators of Compromise

• HTTP requests to the userinfo endpoint containing SQL metacharacters such as ', --, ;, or UNION SELECT
• Anomalous response sizes or HTTP 500 errors from the userinfo endpoint indicating query failures during injection probing
• Database query logs showing malformed or unusually long SELECT statements originating from the web application
• Outbound data transfer spikes correlated with requests to the userinfo endpoint

Detection Strategies

• Inspect web server and application logs for requests to userinfo containing SQL injection signatures including encoded variants
• Deploy a web application firewall rule set tuned to identify SQL injection patterns targeting userinfo parameters
• Correlate database error events with inbound HTTP requests using a SIEM to identify probing activity

Monitoring Recommendations

• Enable verbose request logging for the userinfo endpoint including query strings and request bodies
• Forward web and database logs to a centralized analytics platform for retrospective analysis
• Alert on repeated client requests producing database errors within short time windows

How to Mitigate CVE-2026-40810

Immediate Actions Required

• Apply the vendor patch referenced in the CERT-VDE Security Advisory VDE-2026-044 as soon as it is available for your deployment
• Restrict network access to the userinfo endpoint to trusted management networks until patching is complete
• Review database and application logs for prior indicators of exploitation attempts
• Rotate credentials and secrets that may have been exposed through the database

Patch Information

Vendor patch details are provided through the CERT-VDE Security Advisory VDE-2026-044. Operators should consult the advisory for fixed version numbers and upgrade procedures specific to their product variant.

Workarounds

• Place the affected service behind a web application firewall configured to block SQL injection payloads targeting the userinfo endpoint
• Apply network segmentation to limit exposure of the application to untrusted networks
• Enforce least-privilege database accounts so the application cannot read tables outside its functional requirements
• Monitor and rate-limit access to the userinfo endpoint to slow automated exploitation

# Example WAF rule pattern (ModSecurity-style) to flag SQLi attempts on userinfo
SecRule REQUEST_URI "@contains /userinfo" \
  "chain,deny,status:403,id:1040810,msg:'Potential SQLi against userinfo (CVE-2026-40810)'"
SecRule ARGS "@rx (?i)(union\s+select|--|';|/\*|sleep\(|benchmark\()"