CVE-2026-73405: Vulnerability-Lookup Auth Bypass Flaw

CVE-2026-73405 Overview

CVE-2026-73405 is an authorization bypass vulnerability in Vulnerability-Lookup that permitted inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams via the /pubsub/subscribe/<topic> endpoint. The token_required decorator validated requests solely by matching the X-API-KEY header against a known API key, without checking the account's is_active and is_confirmed state. Because self-registration issues an API key before account confirmation, an attacker could register an account and immediately consume Pub/Sub streams containing pre-moderation data such as newly submitted comments. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Unconfirmed accounts could subscribe to real-time SSE streams and receive not-yet-moderated data that should be restricted to active, confirmed users.

Affected Products

Vulnerability-Lookup (Pub/Sub SSE interface in website/web/views/pubsub.py)
Deployments exposing the /pubsub/subscribe/<topic> endpoint
Instances allowing self-registration prior to email confirmation

Discovery Timeline

2026-08-12 - CVE-2026-73405 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73405

Vulnerability Analysis

The vulnerability stems from inconsistent authorization enforcement between the REST API and the SSE streaming interface of Vulnerability-Lookup. The REST API auth_func in website/web/api/v1/common.py verifies that authenticated accounts are both active and confirmed before granting access. The token_required decorator protecting the Pub/Sub interface only checked whether the submitted X-API-KEY matched a user record in the database.

Because Vulnerability-Lookup's self-registration flow provisions an API key at account creation, an attacker could register an account and immediately obtain a functional key. That key was sufficient to authenticate to the SSE endpoint despite the account remaining unconfirmed. Subscribers received real-time stream events, including data that had not yet passed moderation.

Root Cause

The root cause is a missing authorization check [CWE-862] in the SSE authentication path. Account-state gating enforced elsewhere in the application was omitted from the Pub/Sub decorator, creating an authorization boundary weaker than the REST API's.

Attack Vector

An attacker with network access to a Vulnerability-Lookup instance completes self-registration to obtain an API key. The attacker then issues an authenticated HTTP request to /pubsub/subscribe/<topic> using the X-API-KEY header and receives streaming events for the requested topic. No email confirmation, administrator approval, or privilege escalation is required.

python

            if not user:
                return jsonify({"error": "Invalid API token"}), 403

+            # Enforce the same account-state gate as the REST API
+            # (see website/web/api/v1/common.py:auth_func): an inactive or
+            # unconfirmed account must not reach the stream, otherwise a key
+            # issued before confirmation could subscribe to pre-moderation data.
+            if not user.is_active:
+                return jsonify({"error": "Account is not active."}), 403
+            if not user.is_confirmed:
+                return jsonify({"error": "Account is not confirmed."}), 403
+
            # Store the authenticated user in Flask's `g` object
            g.current_user = user
        except SQLAlchemyError as e:

Source: GitHub Commit bef8372 — patch adding is_active and is_confirmed checks to the SSE token_required decorator.

Detection Methods for CVE-2026-73405

Indicators of Compromise

HTTP requests to /pubsub/subscribe/<topic> originating from accounts that have never completed email confirmation.
Long-lived SSE connections associated with API keys tied to accounts in an is_confirmed=false state.
Bursts of new account registrations followed immediately by Pub/Sub subscription attempts from the same source IP.

Detection Strategies

Correlate application logs of /pubsub/subscribe/ requests with the database is_active and is_confirmed fields for the associated user.
Alert when API keys authenticate to SSE endpoints prior to any confirmation event being recorded for the owning account.
Review web server access logs for unauthenticated-to-authenticated transitions occurring faster than a typical email confirmation round-trip.

Monitoring Recommendations

Ingest Vulnerability-Lookup application and access logs into a centralized SIEM for cross-referencing account state with endpoint access.
Track registration-to-subscription latency and flag outliers indicative of automated abuse.
Monitor for repeated 200-series responses on /pubsub/subscribe/<topic> from single API keys consuming multiple topics.

How to Mitigate CVE-2026-73405

Immediate Actions Required

Upgrade Vulnerability-Lookup to a version containing commit bef8372 or later that enforces is_active and is_confirmed checks on the SSE decorator.
Audit existing accounts and revoke API keys belonging to accounts that remain unconfirmed.
Review Pub/Sub topic contents that may have been exposed and rotate any sensitive stream data.

Patch Information

The fix is delivered in commit bef837242657acf680832be56b94428df130ed67 in the vulnerability-lookup/vulnerability-lookup repository. The patch modifies website/web/views/pubsub.py to reject requests from accounts that are not both active and confirmed, aligning the SSE authorization boundary with the REST API.

Workarounds

Restrict network access to the /pubsub/subscribe/<topic> endpoint using a reverse proxy or WAF rule until the patch is applied.
Disable self-registration or require administrator approval before API keys are issued.
Invalidate API keys for any account whose confirmation is still pending.

bash

# Example nginx block to restrict /pubsub/subscribe/ to a trusted network
location ~ ^/pubsub/subscribe/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://vulnerability_lookup_upstream;
}