CVE-2026-82906: sdcb chats Auth Bypass Vulnerability

CVE-2026-82906 Overview

CVE-2026-82906 is a missing authentication vulnerability in sdcb chats up to version 1.12.0. The flaw resides in the DownloadPublic function within src/BE/web/Controllers/Chats/Files/FileController.cs, part of the Signed File Download Endpoint component. An unauthenticated remote attacker can reach the endpoint over the network and retrieve files without providing credentials. The weakness is categorized as [CWE-287] Improper Authentication. The vendor was contacted prior to disclosure but did not respond, and a public proof-of-concept has been released.

Critical Impact
Remote attackers can access the Signed File Download Endpoint without authentication, exposing files intended to be access-controlled.

Affected Products

sdcb chats versions up to and including 1.12.0
Component: Signed File Download Endpoint (FileController.cs)
Function: DownloadPublic

Discovery Timeline

2026-08-31 - CVE-2026-82906 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82906

Vulnerability Analysis

The vulnerability affects the DownloadPublic method in src/BE/web/Controllers/Chats/Files/FileController.cs. This endpoint serves files through a signed download flow but omits an authentication check on incoming requests. As a result, any remote client can invoke the endpoint and download resources that the application logic assumes are gated. The issue maps to [CWE-287] Improper Authentication. Attack complexity is rated high, and exploitability is described as difficult, meaning attackers must satisfy non-trivial conditions such as valid signed parameters or predictable identifiers to retrieve content.

Root Cause

The root cause is missing authentication enforcement on the DownloadPublic controller action. The endpoint relies on the presence of a signed URL or public path convention rather than verifying a caller identity or session. When authorization is delegated entirely to a signature or path property without server-side identity validation, requests that meet the parameter format succeed regardless of who sends them.

Attack Vector

Exploitation occurs over the network. An attacker crafts an HTTP request against the exposed DownloadPublic endpoint of a vulnerable sdcb chats instance. Because no authentication is required, the request is processed based solely on the request parameters. A public proof-of-concept is available in the referenced GitHub PoC Repository. No verified code examples are reproduced here; refer to the PoC and VulDB CVE-2026-82906 for technical details.

Detection Methods for CVE-2026-82906

Indicators of Compromise

Unauthenticated HTTP requests to routes handled by DownloadPublic in FileController.cs.
Successful 200 OK file download responses without a corresponding authenticated session or cookie.
Unusual volumes of requests to public file download URLs from a single source address.

Detection Strategies

Inspect web server and application logs for requests to the Signed File Download Endpoint that lack authentication headers or session tokens.
Correlate download activity with user session context; flag downloads that cannot be tied to an authenticated principal.
Deploy web application firewall rules to alert on repeated access to the DownloadPublic path from unauthenticated clients.

Monitoring Recommendations

Enable verbose access logging on the sdcb chats backend and forward logs to a centralized analytics platform for review.
Monitor for enumeration patterns against file identifier parameters passed to DownloadPublic.
Track outbound bandwidth spikes from the chats service that may indicate bulk file exfiltration.

How to Mitigate CVE-2026-82906

Immediate Actions Required

Restrict network exposure of the sdcb chats service to trusted networks until a fix is available.
Place the DownloadPublic endpoint behind an authenticating reverse proxy or gateway that validates user sessions.
Audit existing signed URLs and rotate signing keys to invalidate any that may have been captured or predicted.

Patch Information

No vendor patch has been published. According to the disclosure, the vendor was contacted early but did not respond. Monitor the sdcb chats project references for updates and apply a fixed release when versions later than 1.12.0 address the missing authentication check.

Workarounds

Add server-side authentication middleware to the route mapped to DownloadPublic so requests without a valid session are rejected.
Shorten the validity window of signed URLs and bind signatures to authenticated user identifiers where feasible.
Restrict access to the endpoint at the network layer using IP allowlists or VPN-only reachability.

bash

# Configuration example
# Example reverse proxy rule requiring authentication before reaching DownloadPublic
# location /api/chats/files/DownloadPublic {
#     auth_request /auth/validate;
#     proxy_pass http://sdcb-chats-backend;
# }