CVE-2026-79577: SSO-Master Authentication Bypass Vulnerability

CVE-2026-79577 Overview

CVE-2026-79577 is an authentication bypass vulnerability in the /cas/login component of sso-master v1.0.0. Attackers can authenticate to the application without supplying a valid password by sending a crafted POST request to the login endpoint. The flaw affects a Central Authentication Service (CAS) implementation, meaning a single successful bypass may grant access to any downstream service that trusts the SSO provider.

Critical Impact
Unauthenticated remote attackers can impersonate arbitrary users by issuing a crafted POST request to /cas/login, defeating the primary authentication control of the SSO service.

Affected Products

sso-master v1.0.0
Applications relying on sso-master v1.0.0 for CAS-based authentication
Downstream services trusting sso-master session tokens

Discovery Timeline

2026-09-08 - CVE-2026-79577 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79577

Vulnerability Analysis

The vulnerability resides in the /cas/login handler of sso-master v1.0.0. The endpoint accepts POST requests carrying authentication parameters but fails to enforce a mandatory password check under specific request conditions. As a result, an attacker submitting a specially crafted request body can complete the login flow and obtain a valid authenticated session tied to a target account.

Because sso-master implements a CAS-style single sign-on provider, an authenticated session issued by the SSO layer typically propagates trust to every integrated relying party. A single bypass therefore expands into broad unauthorized access across every application federated to the SSO instance.

Root Cause

The root cause is improper enforcement of credential validation in the login controller. The /cas/login endpoint processes the POST request and issues an authenticated session without confirming that the submitted password matches the stored credential for the requested username. This is an authentication bypass consistent with weaknesses in the CWE-287 family (Improper Authentication).

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP POST request to the /cas/login endpoint of a vulnerable sso-master v1.0.0 deployment. No prior credentials, tokens, or user interaction are required. Full technical reproduction details are published in the GitHub CVE PoC Repository.

No verified exploitation code is reproduced here. Refer to the linked proof-of-concept for request structure and parameter details.

Detection Methods for CVE-2026-79577

Indicators of Compromise

POST requests to /cas/login that return successful authentication responses but lack the expected password parameter or contain malformed credential fields.
Successful CAS ticket issuance events for user accounts that have no corresponding password-verification log entry.
Session establishment from unfamiliar source IP addresses immediately followed by access to multiple federated applications.

Detection Strategies

Instrument the sso-master login controller to log every authentication decision, including the username, source IP, and whether password verification actually executed.
Correlate CAS ticket-granting events against the authentication provider's password-check logs to surface tickets issued without a matching verification.
Deploy application-layer rules on the reverse proxy or WAF that flag POST requests to /cas/login with anomalous body structures.

Monitoring Recommendations

Track login success rates per source IP and alert on bursts of successful logins from a single origin across multiple accounts.
Monitor for CAS service ticket issuance for privileged accounts outside normal working hours or from new geolocations.
Forward sso-master access and application logs to a centralized analytics platform for cross-account correlation.

How to Mitigate CVE-2026-79577

Immediate Actions Required

Restrict network access to the sso-master /cas/login endpoint to trusted networks or an authenticated reverse proxy until a fix is deployed.
Invalidate all active sso-master sessions and CAS tickets, then require re-authentication for every user.
Audit authentication logs for successful /cas/login events that lack a corresponding password verification.
Rotate credentials and secrets for any account that shows suspicious SSO activity.

Patch Information

No vendor patch has been published in the referenced advisory sources at the time of writing. Consult the GitHub CVE PoC Repository for the latest technical details and monitor the upstream sso-master project for a fixed release before returning the service to production.

Workarounds

Place sso-master behind a reverse proxy that enforces mutual TLS or an additional authentication layer in front of /cas/login.
Add a WAF rule that rejects POST requests to /cas/login unless the body contains the expected credential fields in the expected format.
Require multi-factor authentication at the relying-party layer so a bypassed CAS session cannot complete downstream logins on its own.
Disable the vulnerable sso-master v1.0.0 instance and fail over to a hardened SSO provider if a timely upstream fix is not available.

bash

# Example WAF rule: block /cas/login POST requests missing a password field
# ModSecurity syntax
SecRule REQUEST_URI "@streq /cas/login" \
  "phase:2,chain,deny,status:400,id:1079577,\
   msg:'CVE-2026-79577: /cas/login POST missing password parameter'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule &ARGS_POST:password "@eq 0"