CVE-2026-72561 Overview
CVE-2026-72561 is a broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217. The flaw resides in an unprotected configuration endpoint that manages global OpenID Connect (OIDC) and Single Sign-On (SSO) settings. The endpoint fails to enforce an administrative role check before applying new OIDC issuer values. Any authenticated non-administrative user can reconfigure the platform to redirect SSO logins to an attacker-controlled identity provider. This enables credential harvesting for every user of the affected Peppermint instance. The issue is classified under CWE-284: Improper Access Control.
Critical Impact
A low-privileged authenticated user can hijack the global SSO configuration, redirecting all subsequent authentication flows to a malicious identity provider and harvesting credentials from every platform user.
Affected Products
- Peppermint Lab Peppermint through commit ba6e217
- Peppermint self-hosted deployments exposing the OIDC/SSO configuration endpoint
- Any Peppermint instance with multiple authenticated users where non-admins can reach the configuration API
Discovery Timeline
- 2026-08-11 - CVE-2026-72561 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72561
Vulnerability Analysis
Peppermint is an open-source ticketing and helpdesk platform. The vulnerable configuration endpoint accepts requests to update global OIDC issuer settings without validating the caller's role. Server-side authorization logic only verifies that a session is authenticated, not that the caller holds administrator privileges. This gap converts a routine authenticated session into full control over the platform's federated authentication flow.
Once the OIDC issuer is altered, every subsequent SSO login attempt is redirected to the attacker's endpoint. Users see a legitimate Peppermint login prompt initiating the redirect. The attacker then receives credentials or authorization codes that can be replayed against the real identity provider. The impact scales with the number of users on the affected tenant, and administrator accounts are equally exposed once they attempt to sign in.
Root Cause
The root cause is missing role-based access control (RBAC) enforcement on the OIDC/SSO configuration route. The handler checks session validity but omits an isAdmin or equivalent authorization predicate before persisting configuration changes. This is a classic broken access control failure aligned with CWE-284.
Attack Vector
Exploitation requires network access to the Peppermint API and any authenticated non-administrative account. The attacker sends a crafted request to the configuration endpoint containing attacker-controlled OIDC issuer, authorization, and token URLs. After the change is applied, the attacker waits for legitimate users to authenticate via SSO. Each subsequent login flow is redirected to the attacker's identity provider, which captures credentials or intercepts authorization codes.
No verified public proof-of-concept code is available. Technical details can be reviewed through the Peppermint GitHub repository, which hosts the affected source code.
Detection Methods for CVE-2026-72561
Indicators of Compromise
- Unexpected modifications to Peppermint OIDC issuer, authorization endpoint, or token endpoint values in the application configuration store
- Outbound authentication redirects to unfamiliar or newly registered domains during SSO flows
- Authenticated API requests to the OIDC/SSO configuration endpoint originating from non-administrator user accounts
- User reports of unexpected login prompts, certificate warnings, or credential re-entry during SSO
Detection Strategies
- Audit Peppermint application and database logs for changes to OIDC configuration records and correlate the acting user against the administrator role list
- Monitor HTTP access logs for POST or PUT requests to the OIDC/SSO configuration route made by non-admin session tokens
- Compare running OIDC issuer values against a known-good baseline configuration on a scheduled basis
Monitoring Recommendations
- Alert on any modification to identity provider configuration for helpdesk and ticketing platforms
- Track newly observed OIDC issuer domains at the network egress layer for authentication-related traffic
- Enable and centralize Peppermint application logs to a SIEM for correlation with identity provider sign-in telemetry
How to Mitigate CVE-2026-72561
Immediate Actions Required
- Restrict network access to the Peppermint administrative and configuration endpoints to trusted administrator networks until a patched build is deployed
- Review the current OIDC issuer, authorization URL, and token URL settings and confirm they match the sanctioned identity provider
- Rotate credentials and revoke active sessions if unauthorized configuration changes are found
- Audit user accounts and remove or downgrade unnecessary authenticated accounts on internet-facing instances
Patch Information
No fixed release version is listed in the NVD entry for CVE-2026-72561 at the time of publication. Monitor the Peppermint GitHub repository for commits addressing the missing administrator role check on the OIDC/SSO configuration endpoint and upgrade beyond commit ba6e217 once a fix is published.
Workarounds
- Place the Peppermint configuration API behind a reverse proxy that enforces IP allow-listing for administrator networks
- Apply web application firewall (WAF) rules blocking non-admin sessions from reaching the OIDC/SSO configuration route
- Temporarily disable self-service or invited user registration on internet-exposed instances to reduce the pool of authenticated attackers
- Enforce multi-factor authentication at the upstream identity provider so intercepted primary credentials alone cannot complete authentication
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
