CVE-2026-42604: Actual Budget Information Disclosure Flaw

CVE-2026-42604 Overview

CVE-2026-42604 affects Actual Budget, a local-first personal finance tool. The POST /openid/config endpoint in the sync-server exposes the full OpenID Connect (OIDC) configuration, including the OAuth2 client_secret, to any caller who supplies the bootstrap password. The endpoint lacks authentication and rate limiting, so the bootstrap password is brute-forceable over the network. The flaw is categorized under CWE-863: Incorrect Authorization. Version 26.5.0 resolves the issue. Affected deployments include all sync-server releases at or below version 26.4.0.

Critical Impact
A remote attacker who brute-forces the bootstrap password can extract the OAuth2 client_secret and impersonate the OIDC client, leading to identity takeover of Actual Budget instances.

Affected Products

Actual Budget sync-server versions <= 26.4.0
Self-hosted Actual Budget deployments using OpenID Connect
Fixed in Actual Budget sync-server version 26.5.0

Discovery Timeline

2026-06-12 - CVE-2026-42604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-42604

Vulnerability Analysis

The vulnerability resides in the POST /openid/config route of the Actual Budget sync-server. The endpoint is intended to return the active OpenID Connect configuration when called with the correct bootstrap password. However, the response payload includes the OAuth2 client_secret alongside other configuration values. Any caller who presents a valid bootstrap password receives the secret directly, regardless of session or administrative context.

The endpoint compounds this exposure by omitting authentication beyond the bootstrap password and applying no rate limiting. An attacker can issue unlimited password guesses against the route from the network. Once the bootstrap password is recovered, the attacker retrieves the OIDC client credentials and can mint tokens against the configured identity provider.

Root Cause

The root cause is an authorization design flaw [CWE-863]. The sync-server treats knowledge of the bootstrap password as sufficient proof of administrative intent and returns sensitive secrets in plaintext. No defense-in-depth controls — such as request throttling, lockout, or secret redaction — guard the route. The bootstrap password was not designed to protect high-value credentials, yet it gates access to the OIDC client_secret.

Attack Vector

An unauthenticated attacker reachable over the network targets the sync-server's POST /openid/config endpoint. The attacker iterates candidate bootstrap passwords without facing rate limits. After a successful guess, the server returns the complete OIDC configuration, including client_id, issuer URL, and client_secret. The attacker then uses these credentials to forge authentication flows or impersonate the application against the identity provider, potentially gaining administrative access to budgets and synced financial data.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-49v6-pqjq-xw55 for technical details.

Detection Methods for CVE-2026-42604

Indicators of Compromise

Repeated POST requests to the /openid/config endpoint from a single source IP within a short window
HTTP 401 or 403 responses to /openid/config followed by a successful 200 response
Unexpected OIDC token issuance events for the Actual Budget client outside normal user sign-in patterns
Sync-server logs showing access to OIDC configuration from non-administrative networks

Detection Strategies

Inspect reverse-proxy and application logs for high-volume access to /openid/config and alert on burst patterns
Correlate sync-server access logs with identity provider authentication logs to identify mismatched client usage
Hunt for OIDC token requests using the Actual Budget client_id originating from unexpected IP addresses or user agents

Monitoring Recommendations

Forward sync-server HTTP access logs and OIDC provider audit logs to a centralized analytics platform for retention and correlation
Configure alerts for any password-guessing behavior against authentication-adjacent endpoints exposed by the sync-server
Track the integrity of OIDC client secrets and rotate them on any indication of unauthorized configuration access

How to Mitigate CVE-2026-42604

Immediate Actions Required

Upgrade Actual Budget sync-server to version 26.5.0 or later without delay
Rotate the OAuth2 client_secret at the identity provider after upgrading, treating the previous secret as compromised
Reset the bootstrap password to a high-entropy value following the upgrade
Review sync-server and identity provider logs for prior access to /openid/config and anomalous token issuance

Patch Information

Actual Budget released sync-server version 26.5.0 to remediate CVE-2026-42604. Review the Actual Budget 26.5.0 release notes and the GitHub Security Advisory GHSA-49v6-pqjq-xw55 for upgrade instructions and the full scope of the fix.

Workarounds

Restrict network exposure of the sync-server so the /openid/config endpoint is reachable only from trusted administrative networks
Place the sync-server behind a reverse proxy that enforces rate limiting and IP allow-listing on authentication-adjacent routes
Disable OpenID Connect on the sync-server until the upgrade to 26.5.0 is complete if the feature is not required

bash

# Example nginx rate-limit and allow-list for /openid/config until patched
limit_req_zone $binary_remote_addr zone=oidc_cfg:10m rate=5r/m;

location = /openid/config {
    allow 10.0.0.0/8;        # trusted admin network
    deny  all;
    limit_req zone=oidc_cfg burst=2 nodelay;
    proxy_pass http://actual_sync_upstream;
}