CVE-2026-81906: Concrete CMS OAuth Authentication Bypass Flaw

CVE-2026-81906 Overview

CVE-2026-81906 is an authentication bypass vulnerability in Concrete CMS versions prior to 9.5.3. The OAuth callback login path failed to verify whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a fully authenticated session. The login was recorded and login events were dispatched, giving the attacker the appearance of a legitimate session. The Concrete CMS security team assigned this issue a CVSS v4.0 score of 6.3. The flaw is categorized under [CWE-288]: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Deactivated or email-unvalidated accounts with prior OAuth bindings can obtain authenticated sessions, bypassing account state controls.

Affected Products

Concrete CMS versions prior to 9.5.3
Concrete CMS deployments using OAuth-based authentication
Any Concrete CMS instance that binds external identity providers to user accounts

Discovery Timeline

Vulnerability reported by Yonatan Drori from Tenzai
2026-09-11 - CVE-2026-81906 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-81906

Vulnerability Analysis

The vulnerability resides in the OAuth callback handler of Concrete CMS. When an external identity provider returns a successful authentication assertion to the callback endpoint, the application locates the local user account bound to that OAuth identity and establishes a session. The callback path omits the account state checks that the standard login flow enforces. Account status flags such as active and email-validated are not evaluated before the session is created. As a result, users whose accounts an administrator has disabled, or users who never completed email verification, can still authenticate through the OAuth path.

The response returned to the callback includes a fully authenticated session cookie. The application also records the login and dispatches login events, meaning downstream listeners treat the session as legitimate. This weakens administrative controls that assume deactivation prevents future access.

Root Cause

The root cause is missing authorization logic in an alternate authentication channel [CWE-288]. The primary login flow enforces account state validation, but the OAuth callback handler does not. This inconsistency between authentication paths creates a bypass condition where the OAuth channel becomes a trusted route that skips security checks applied elsewhere.

Attack Vector

Exploitation requires an existing OAuth binding between the target user account and a supported identity provider. An attacker who controls a deactivated account, or who registered but never validated the email, can initiate the OAuth flow at the identity provider. Upon redirect to the Concrete CMS callback URL, the application issues a session without verifying account state. The attack vector is network-based and requires no privileges or user interaction beyond completing the OAuth handshake. Refer to the Concrete CMS Version 9.5.3 Release Notes for vendor details.

Detection Methods for CVE-2026-81906

Indicators of Compromise

Successful login events for user accounts marked as deactivated in the administrative console
Session establishment records tied to accounts with is_validated = false or equivalent unverified email state
OAuth callback requests followed by authenticated activity from accounts that should not be able to authenticate

Detection Strategies

Correlate authentication logs against the user status table to flag sessions created for deactivated or unvalidated accounts
Monitor OAuth callback endpoints for authentication completions that bypass the standard login pathway
Compare login event streams between primary login and OAuth callback flows to identify state-check discrepancies

Monitoring Recommendations

Enable verbose logging on the OAuth callback handler and forward records to a centralized log platform
Alert on any authenticated request from a user account whose active flag was cleared prior to the session start time
Review historical OAuth login events during the window preceding patch deployment to identify prior misuse

How to Mitigate CVE-2026-81906

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later
Audit the user table for accounts flagged as deactivated or unvalidated that hold active OAuth bindings
Revoke active sessions and force reauthentication for users with existing OAuth bindings
Review authentication logs for OAuth callback logins associated with disabled accounts

Patch Information

Concrete CMS addressed this issue in version 9.5.3. The fix enforces account active state and email validation checks in the OAuth callback login path, aligning it with the primary login flow. See the Concrete CMS Version 9.5.3 Release Notes for the full change list.

Workarounds

Disable OAuth authentication providers on affected Concrete CMS instances until the patch is applied
Remove OAuth bindings from deactivated or unvalidated user accounts to eliminate the exploitation prerequisite
Restrict access to the OAuth callback endpoint using upstream web application firewall rules while an upgrade is scheduled

bash

# Configuration example
# Verify the running Concrete CMS version and plan an upgrade to 9.5.3 or later
grep -R "APP_VERSION" /var/www/concrete/config/concrete.php
# Review the release notes before applying the update
# https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes