CVE-2026-86274: projeto-siga Auth Bypass Vulnerability

CVE-2026-86274 Overview

CVE-2026-86274 is a missing authorization vulnerability [CWE-862] affecting the projeto-siga siga application versions up to 11.0.2.10, 11.0.2.13, and 11.1.1. The flaw resides in the ExAutenticacaoController.autenticar function within sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java, part of the Authentication Flow component. Remote attackers can manipulate the cod or jwt arguments to bypass authorization checks. The exploit has been publicly disclosed. The project maintainers were notified through an issue report but have not yet responded.

Critical Impact

Remote attackers can manipulate the cod and jwt arguments in the authentication controller to bypass authorization checks with no privileges or user interaction required.

Affected Products

• projeto-siga siga version 11.0.2.10
• projeto-siga siga version 11.0.2.13
• projeto-siga siga version 11.1.1

Discovery Timeline

• 2026-09-07 - CVE-2026-86274 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86274

Vulnerability Analysis

The vulnerability affects the autenticar method of the ExAutenticacaoController class in the sigaex module of the SIGA (Sistema Integrado de Gestão Administrativa) platform. The controller handles authentication requests using two parameters, cod and jwt, but fails to enforce proper authorization checks before granting access. This missing authorization condition permits an unauthenticated remote actor to interact with authenticated functionality by supplying crafted values for these arguments.

The attack proceeds over the network without user interaction. According to the disclosure, the project was notified through an issue report but has not yet responded, meaning no vendor patch is currently referenced. A public exploit disclosure exists, increasing the likelihood of opportunistic attempts against exposed instances.

Root Cause

The root cause is an authorization gap in the ExAutenticacaoController.autenticar handler. The function accepts the cod and jwt request parameters and processes authentication logic without validating that the caller is authorized to act on the referenced identity or token context. This aligns with CWE-862: Missing Authorization, where the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack Vector

Exploitation requires only network access to a vulnerable SIGA instance. An attacker crafts an HTTP request to the authentication endpoint and supplies attacker-controlled values in the cod or jwt parameters. Because the controller does not verify authorization, the request is processed as if it originated from a legitimate context. The vulnerability requires no prior credentials and no user interaction. Technical details are tracked in the GitHub Issue #2493 and the VulDB entry for CVE-2026-86274.

Detection Methods for CVE-2026-86274

Indicators of Compromise

• Unexpected HTTP requests to the SIGA authentication endpoint containing anomalous or malformed cod or jwt query parameters.
• Authentication log entries associated with the ExAutenticacaoController.autenticar handler that lack corresponding session establishment context.
• Access to authenticated SIGA resources without a preceding successful interactive login event.

Detection Strategies

• Instrument the sigaex application to log all invocations of ExAutenticacaoController.autenticar including source IP, cod value, and jwt value.
• Deploy web application firewall (WAF) rules to identify repeated or malformed authentication requests targeting the affected controller path.
• Correlate authentication events against subsequent privileged actions to flag sessions that bypass normal login flows.

Monitoring Recommendations

• Aggregate SIGA application logs into a centralized analytics platform and alert on anomalous authentication request volume per source IP.
• Monitor for repeated 200-OK responses to authentication requests originating from unusual geographies or non-corporate networks.
• Track error rates and parameter tampering signatures on the sigaex authentication endpoint to identify enumeration attempts.

How to Mitigate CVE-2026-86274

Immediate Actions Required

• Restrict network exposure of SIGA instances to trusted networks or VPN-accessible segments until a vendor fix is available.
• Place the sigaex authentication endpoint behind a reverse proxy that enforces IP allowlisting and request rate limits.
• Audit recent authentication logs for suspicious cod and jwt parameter values and investigate any unrecognized session activity.
• Subscribe to updates on the projeto-siga GitHub repository and Issue #2493 for remediation status.

Patch Information

At the time of publication, the project maintainers have not responded to the issue report and no official patch is referenced in the CVE record. Organizations running affected versions 11.0.2.10, 11.0.2.13, or 11.1.1 should track the GitHub Issue #2493 for maintainer updates and apply any forthcoming security release immediately.

Workarounds

• Apply a custom authorization filter in front of ExAutenticacaoController.autenticar that validates the caller context before parameters are processed.
• Enforce mutual TLS or an upstream authentication proxy on the SIGA authentication endpoint to prevent unauthenticated access.
• Disable or restrict routes that accept the cod and jwt parameters if the deployment does not require them for legitimate integration flows.

# Example nginx configuration restricting the authentication endpoint to trusted networks
location /sigaex/public/app/autenticar {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://siga_backend;
}