CVE-2026-5749: Fullstep V5 Auth Bypass Vulnerability

CVE-2026-5749 Overview

CVE-2026-5749 is a missing authentication vulnerability (CWE-306) affecting Fullstep V5, a business process management platform. The vulnerability exists in the registration process and allows unauthenticated users to obtain a valid JWT token, which can then be used to interact with authenticated API resources. This broken access control flaw enables unauthorized access to protected API endpoints without proper authentication.

Critical Impact

Unauthenticated attackers can obtain valid JWT tokens and access authenticated API resources, potentially compromising the confidentiality of sensitive data managed by the Fullstep V5 platform.

Affected Products

• Fullstep V5

Discovery Timeline

• 2026-04-22 - CVE-2026-5749 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-5749

Vulnerability Analysis

This vulnerability stems from inadequate access control mechanisms in the Fullstep V5 registration process. The flaw allows unauthenticated users to bypass authentication requirements and obtain valid JWT (JSON Web Token) tokens. Once an attacker possesses a valid token, they can interact with API endpoints that should only be accessible to authenticated users.

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), indicating that a critical function—specifically the token issuance mechanism—lacks proper authentication checks. This type of flaw is particularly dangerous in API-driven applications where tokens serve as the primary means of access control.

Root Cause

The root cause of CVE-2026-5749 is the missing authentication validation in the registration workflow of Fullstep V5. The application fails to properly verify user identity before issuing JWT tokens, allowing unauthenticated users to obtain tokens that grant access to protected resources. This represents a fundamental design flaw in the authentication architecture where token generation is not properly gated behind identity verification.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability remotely by:

1. Accessing the Fullstep V5 registration endpoint without valid credentials
2. Manipulating the registration process to trigger JWT token generation
3. Obtaining a valid JWT token without completing proper authentication
4. Using the acquired token to access authenticated API resources
5. Exfiltrating sensitive data accessible through the API

The attack mechanism involves exploiting the gap between the registration process and token issuance, where proper authentication checks are not enforced. For detailed technical information, refer to the INCIBE Security Notice.

Detection Methods for CVE-2026-5749

Indicators of Compromise

• Unusual JWT token generation requests from unauthenticated sessions
• API access patterns showing authenticated endpoint access without corresponding login events
• Anomalous registration requests that do not follow normal user registration workflows
• High volume of token requests from single IP addresses without completed registrations

Detection Strategies

• Monitor registration endpoints for requests that result in JWT token issuance without proper authentication completion
• Implement logging for all JWT token generation events and correlate with successful authentication events
• Deploy API gateway rules to detect and alert on authenticated API access without corresponding authentication records
• Review access logs for patterns of API resource access immediately following registration attempts

Monitoring Recommendations

• Enable detailed logging on Fullstep V5 registration and authentication endpoints
• Configure SIEM rules to alert on JWT token generation without authentication correlation
• Monitor API access patterns for unauthorized data access attempts
• Implement anomaly detection for registration process abuse

How to Mitigate CVE-2026-5749

Immediate Actions Required

• Review and restrict access to the Fullstep V5 registration endpoint
• Implement additional authentication checks before JWT token issuance
• Audit existing JWT tokens for unauthorized access patterns
• Consider implementing IP-based rate limiting on registration endpoints
• Monitor API access logs for signs of exploitation

Patch Information

Organizations should consult the INCIBE Security Notice for official remediation guidance and any available patches from the vendor. Apply security updates as soon as they become available from Fullstep.

Workarounds

• Implement network-level access controls to restrict registration endpoint access to trusted networks
• Deploy a web application firewall (WAF) with rules to detect and block suspicious registration attempts
• Add additional authentication factors or verification steps to the registration process
• Consider temporarily disabling public registration if not business-critical until a patch is available
• Implement token validation checks that verify the authentication state before granting API access

# Example: Restrict registration endpoint access via nginx
# Add to nginx server configuration
location /api/register {
    # Allow only trusted networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Rate limiting
    limit_req zone=registration burst=5 nodelay;
    
    proxy_pass http://fullstep_backend;
}