CVE-2026-45274: MyBooks Authentication Bypass Vulnerability

CVE-2026-45274 Overview

CVE-2026-45274 affects MyBooks (also known as Talebook), an ebook management web server. In version 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag. The frontend hides registration controls when the flag is false, but the backend accepts direct API calls regardless. An unauthenticated remote attacker can call the endpoint and create a valid account on an instance whose administrator disabled public registration. The process_auth_header function in webserver/handlers/base.py also fails to verify the account's active flag, allowing the new unactivated account to authenticate immediately.

Critical Impact
Unauthenticated attackers can bypass administrator-disabled registration and obtain an authenticated low-privilege account, supplying the foothold required by related authorization vulnerabilities.

Affected Products

MyBooks (Talebook) versions 3.41.2 and earlier
Fixed in MyBooks version 3.42.0
Component: webserver/handlers/user.py and webserver/handlers/base.py

Discovery Timeline

2026-08-19 - CVE-2026-45274 published to NVD
2026-08-19 - Last updated in NVD database
Version 3.42.0 - Vendor released security patch via GitHub Release v3.42.0

Technical Details for CVE-2026-45274

Vulnerability Analysis

The flaw combines two server-side trust failures classified under [CWE-602] Client-Side Enforcement of Server-Side Security. The registration endpoint trusts the frontend to enforce the ALLOW_REGISTER policy, while the authentication middleware trusts the account creation flow to only produce active accounts. Neither assumption holds when an attacker interacts with the API directly.

An attacker sends a crafted POST /api/user/sign_up request bypassing UI restrictions. The server creates the account without checking ALLOW_REGISTER. The attacker then authenticates using the new credentials because process_auth_header never validates the active attribute on the user record. The resulting session has user-level API access on instances that were explicitly configured as closed.

Root Cause

The SignUp.post handler omits a server-side check on the ALLOW_REGISTER flag before persisting a new user. The process_auth_header function in webserver/handlers/base.py validates the password but does not check user.active. Both controls existed only on the client or in the activation workflow.

Attack Vector

Exploitation requires network access to the MyBooks web interface. No authentication, user interaction, or elevated privileges are needed. The attacker submits a standard sign-up JSON body to the API, then supplies the credentials via the normal auth header flow to gain a working session.

python

# Security patch in webserver/handlers/base.py (v3.42.0)
# Source: https://github.com/PoxenStudio/mybooks/commit/a1780c98b00566af7da2fc099fe38500efc02e92
            return False
        if user.get_secure_password(password) != str(user.password):
            return False
+       if not user.active:
+           return False
        self.mark_invited()
        self.login_user(user)
        return True

The patch adds an active flag check in the authentication path, blocking sessions for accounts that have not been activated. A companion patch in webserver/handlers/admin.py also adds an admin_user verification to configuration write handlers.

Detection Methods for CVE-2026-45274

Indicators of Compromise

Successful POST /api/user/sign_up requests on instances where the administrator set ALLOW_REGISTER=false.
New user records in the MyBooks database with active=false that have generated authenticated API traffic.
Authenticated API calls originating from accounts that never completed the activation workflow.

Detection Strategies

Review web server access logs for /api/user/sign_up POST requests followed by authenticated calls from the same source IP within a short window.
Correlate database entries in the users table against activation records to identify accounts that authenticated while active was false.
Compare the running MyBooks version against 3.42.0 to identify instances still exposed.

Monitoring Recommendations

Enable HTTP access logging on the reverse proxy fronting MyBooks and forward it to a central log platform.
Alert on any account creation activity when the deployment's registration policy is disabled.
Track first-time authentication events for newly created accounts and validate the activation state.

How to Mitigate CVE-2026-45274

Immediate Actions Required

Upgrade MyBooks to version 3.42.0, which contains the fix in commit a1780c9.
Audit the user table for accounts created since deployment and disable any that were not authorized.
Rotate credentials and invalidate active sessions after upgrading to force re-authentication.

Patch Information

The fix is available in MyBooks 3.42.0. Refer to the GitHub Security Advisory GHSA-3q85-5vj5-qx5v for full details. The patch enforces ALLOW_REGISTER in the sign-up handler and adds an active flag check in process_auth_header.

Workarounds

Restrict network access to the MyBooks web server using an upstream reverse proxy or firewall until the upgrade is applied.
Place the /api/user/sign_up endpoint behind an authentication gate at the reverse proxy layer.
Manually delete or disable any unactivated user records that appear in the database.

bash

# Example nginx block for the sign-up endpoint until 3.42.0 is deployed
location = /api/user/sign_up {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://mybooks_backend;
}