CVE-2026-79576: Digital-Infrastructure SSO Auth Bypass

CVE-2026-79576 Overview

CVE-2026-79576 is an authentication bypass vulnerability in the Single-Sign On (SSO) component of Digital-Infrastructure version 9.6.7. The flaw allows unauthenticated network attackers to authenticate as any user, including the Admin account, without supplying a password. The weakness is classified under [CWE-287] Improper Authentication and is reachable over the network without user interaction. Successful exploitation grants full account takeover, exposing confidentiality, integrity, and availability of the affected application.

Critical Impact
Remote attackers can log in as the Admin user without credentials, achieving complete administrative control over Digital-Infrastructure v9.6.7 deployments.

Affected Products

Digital-Infrastructure v9.6.7 (SSO component)

Discovery Timeline

2026-09-08 - CVE-2026-79576 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79576

Vulnerability Analysis

The vulnerability resides in the SSO authentication logic of Digital-Infrastructure v9.6.7. The SSO component fails to enforce credential validation when processing authentication requests. An attacker can submit a login request that specifies an arbitrary username and be authenticated as that user without providing a password. Because the flaw affects the primary authentication boundary, any account, including privileged administrator accounts, can be impersonated.

Exploitation requires no prior authentication, no user interaction, and can be performed remotely. The Exploit Prediction Scoring System places this issue in the lower activity range at the time of publication, but the pre-authenticated administrative access it grants makes it a high-priority patching target.

Root Cause

The root cause is improper authentication [CWE-287] within the SSO login handler. The component treats an authentication request as valid based on the supplied identity claim without verifying the associated secret. This design flaw removes the password check entirely from the authentication decision, collapsing the trust boundary between anonymous and administrative access.

Attack Vector

The attack vector is network-based against the exposed SSO endpoint. An attacker sends a crafted login request to the SSO service specifying the target account name, such as Admin. The service returns a valid session or authentication token bound to the requested identity. The attacker then uses the token to interact with the application as the impersonated user. Public proof-of-concept details are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-79576

Indicators of Compromise

Successful SSO authentications for privileged accounts such as Admin originating from unfamiliar IP addresses or geographies.
Login events that lack a preceding password validation step in application logs.
Session tokens issued to administrative users during periods of no legitimate administrator activity.
Configuration changes, new privileged account creation, or role modifications immediately following an SSO login event.

Detection Strategies

Correlate SSO authentication logs with source IP reputation and prior login baselines to identify anomalous administrator sign-ins.
Alert on any authentication event where the credential validation field is empty, missing, or bypassed.
Monitor for repeated login attempts across multiple usernames from a single source, which may indicate account enumeration through the bypass.

Monitoring Recommendations

Forward Digital-Infrastructure SSO and application logs to a centralized SIEM for real-time correlation.
Enable audit logging on all administrative operations to establish a reviewable trail of post-authentication activity.
Track outbound connections initiated by application service accounts to detect follow-on activity after account takeover.

How to Mitigate CVE-2026-79576

Immediate Actions Required

Restrict network access to the Digital-Infrastructure SSO endpoint using firewall rules or a reverse proxy allowlist until a patch is applied.
Rotate all administrator credentials and invalidate active sessions to evict any attacker who may have leveraged the bypass.
Review authentication and audit logs for unauthorized administrative access dating back to deployment of v9.6.7.

Patch Information

No vendor advisory or fixed version is referenced in the published CVE data. Administrators should contact the Digital-Infrastructure vendor for an official patched release and monitor the GitHub PoC Repository and NVD entry for updates.

Workarounds

Place the SSO component behind an authenticating reverse proxy or VPN so unauthenticated requests cannot reach the vulnerable endpoint.
Enforce network segmentation to limit exposure of the Digital-Infrastructure management plane to trusted administrative networks.
Disable or block the SSO component if it is not required for business operations until a fix is available.

bash

# Example: restrict SSO endpoint to trusted administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP