CVE-2026-78369: RansomLook Authentication Bypass Vulnerability

CVE-2026-78369 Overview

CVE-2026-78369 is a missing authentication vulnerability [CWE-306] in RansomLook, an open-source threat intelligence platform that tracks ransomware groups. The /admin/crypto/group/new administrative endpoint lacks the application's authentication check. Any unauthenticated remote attacker with network reach to the RansomLook web interface can invoke this route and create arbitrary crypto group entries. The flaw affects the integrity of administrative data managed through the interface and can taint downstream consumers of that data.

Critical Impact
Unauthenticated attackers can create crypto group records reserved for administrators, corrupting data integrity and any information derived from these entries.

Affected Products

RansomLook (open-source project maintained on GitHub)
Versions prior to commit fc25bc4f3d42d3440f9760702c3a5be138bc56a3
Deployments exposing the RansomLook web interface on reachable networks

Discovery Timeline

2026-08-24 - CVE-2026-78369 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78369

Vulnerability Analysis

RansomLook is a Flask-based web application that uses flask_login to gate administrative functionality. Routes intended for administrators are normally protected by the @flask_login.login_required decorator. The admin_crypto_group_new handler, bound to /admin/crypto/group/new, was registered without this decorator. As a result, Flask served the endpoint to any caller regardless of session state.

An attacker submits a GET or POST request directly to the URL and the handler executes the crypto group creation logic. The request writes to the underlying Valkey cache database (DB_CRYPTO) opened via unix_socket_path=get_socket_path("cache"). No credentials, tokens, or origin checks stand between the attacker and the write path. Because the endpoint sits under /admin/, operators reasonably assume authentication is enforced consistently across siblings, which makes the gap easy to miss in review.

The issue maps to CWE-306: Missing Authentication for Critical Function. Exploitation is possible with a single HTTP request and no user interaction.

Root Cause

The route registration omitted the @flask_login.login_required decorator that guards peer administrative routes. Authentication in the RansomLook admin surface is applied per-view rather than through a blueprint-level before_request handler, so a missing decorator silently disables protection for that specific route.

Attack Vector

Exploitation is network-based and requires only reachability to the RansomLook web interface. The attacker sends an HTTP request to /admin/crypto/group/new with parameters accepted by the handler and the server creates the crypto group entry. Malicious entries can then influence any RansomLook feature that consumes crypto group data.

python

@app.route("/admin/crypto/group/new", methods=["GET", "POST"])
+@flask_login.login_required
 def admin_crypto_group_new():  # type: ignore[no-untyped-def]
     red = Valkey(unix_socket_path=get_socket_path("cache"), db=DB_CRYPTO)

Source: RansomLook commit fc25bc4. The patch adds the missing @flask_login.login_required decorator to the vulnerable route.

Detection Methods for CVE-2026-78369

Indicators of Compromise

HTTP requests to /admin/crypto/group/new without a preceding successful authentication flow or valid session cookie.
Unexpected new entries in the DB_CRYPTO Valkey database that do not correspond to administrator activity in access logs.
POST requests to the endpoint originating from external IP addresses or non-administrative source ranges.

Detection Strategies

Review web server and reverse proxy logs for any requests to /admin/crypto/* paths where the requester was not authenticated.
Correlate crypto group creation events with authenticated admin sessions; flag creations lacking a matching session identifier.
Deploy a WAF or reverse-proxy rule that blocks unauthenticated access to /admin/ and alerts on bypass attempts.

Monitoring Recommendations

Alert on HTTP 200 responses to /admin/crypto/group/new from clients that did not authenticate against /login in the same session.
Track anomalies in the size and content of the DB_CRYPTO Valkey database over time.
Monitor for automated scanning patterns targeting admin routes, including sequential probes across /admin/* endpoints.

How to Mitigate CVE-2026-78369

Immediate Actions Required

Update RansomLook to a build that includes commit fc25bc4f3d42d3440f9760702c3a5be138bc56a3 or later.
Restrict network exposure of the RansomLook web interface to trusted administrators via VPN, IP allowlisting, or reverse-proxy authentication.
Audit the DB_CRYPTO Valkey database for unauthorized entries and remove or quarantine suspicious records.

Patch Information

The fix applies @flask_login.login_required to the admin_crypto_group_new view in website/web/__init__.py. See the upstream fix at RansomLook commit fc25bc4. Operators running from source should git pull and restart the Flask application; container-based deployments should rebuild images against the patched revision.

Workarounds

Place the RansomLook application behind a reverse proxy that enforces authentication on all /admin/ paths independently of the application.
Block external access to /admin/crypto/group/new at the network edge until the patch is applied.
Audit remaining routes for the presence of @flask_login.login_required and add the decorator to any administrative view that is missing it.

bash

# Nginx reverse-proxy snippet to block unauthenticated access to admin routes
location /admin/ {
    auth_basic "RansomLook Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:5000;
}