CVE-2026-90451: Authentication Bypass Vulnerability

CVE-2026-90451 Overview

CVE-2026-90451 is a hardcoded secret vulnerability affecting a bundled packet-analysis component in an industrial control system product covered by CISA ICS Advisory ICSA-26-254-01. The product ships an example environment-configuration file containing a fixed, publicly-known secret value used to sign authentication cookies. Deployments that copy the example file into active configuration without executing the setup routine that regenerates the secret continue to use the known default. Any attacker aware of the default value can forge valid authentication cookies and impersonate authenticated users of the affected component. The weakness is classified under CWE-1392: Use of Default Credentials.

Critical Impact
Remote attackers can forge authentication cookies without credentials, bypassing authentication in affected deployments.

Affected Products

Bundled packet-analysis component referenced in CISA ICS Advisory ICSA-26-254-01
Specific vendor and product identifiers are not enumerated in the current NVD entry
Consult the CISA advisory for the authoritative affected-version list

Discovery Timeline

2026-09-11 - CVE-2026-90451 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90451

Vulnerability Analysis

The vulnerability stems from shipping an example environment-configuration file that contains a static, publicly-known secret. This secret is used by the packet-analysis component to sign session or authentication cookies. Cookie signing depends on the secret being unique and confidential per deployment. When the secret is universally known, the integrity guarantee of the signed cookie collapses.

The intended workflow requires operators to run a setup routine that generates a unique secret before the component is placed into production. However, administrators who copy the example file directly to the active configuration path skip the regeneration step. The component then continues signing cookies with the default value from the example file. An attacker who reads the publicly-available example file can reproduce the signing operation offline.

Root Cause

The root cause is the inclusion of a functional signing secret inside a distributed example file, combined with the absence of a runtime check that rejects the known default value. The component treats the presence of any non-empty secret as sufficient to boot. It does not validate the secret against a blocklist of shipped defaults or require proof that the setup routine has executed.

Attack Vector

Exploitation occurs over the network and requires no authentication or user interaction. An attacker constructs an authentication cookie, signs it with the publicly-known default secret, and submits it to the packet-analysis component. The component validates the signature against the same default and accepts the forged cookie as authentic. The attacker then operates with the identity and privileges encoded in the forged cookie, resulting in a loss of integrity for the affected component.

No verified proof-of-concept code is published for this issue. Technical details are described in prose in the CISA ICS Advisory ICSA-26-254-01.

Detection Methods for CVE-2026-90451

Indicators of Compromise

Presence of the shipped example environment-configuration file at the active configuration path with an unchanged default secret value
Authentication cookies presented to the packet-analysis component from unexpected source addresses or geographies
Session activity for administrative accounts without a preceding successful login event in application logs

Detection Strategies

Compare the deployed configuration file hash against the vendor-supplied example file to identify unmodified deployments
Inspect the runtime signing secret and flag any match against the default value published in the vendor example
Correlate authenticated actions in packet-analysis logs against authentication events to identify sessions that appear without corresponding logins

Monitoring Recommendations

Alert on new sessions to the packet-analysis component from source addresses outside approved management networks
Monitor privileged actions performed through the packet-analysis interface and require secondary verification for sensitive operations
Audit configuration files across all deployments on a recurring schedule to confirm setup routines have executed

How to Mitigate CVE-2026-90451

Immediate Actions Required

Run the vendor-supplied setup routine on every deployment to regenerate a unique signing secret and replace the shipped default
Invalidate all existing sessions on affected components after rotating the secret so previously issued cookies cannot be replayed
Restrict network access to the packet-analysis component to trusted management networks until remediation is confirmed

Patch Information

Refer to CISA ICS Advisory ICSA-26-254-01 for the authoritative list of fixed versions and vendor guidance. Apply the vendor-recommended update that removes the default secret from shipped example files and enforces regeneration at startup.

Workarounds

Manually replace the signing secret in the active configuration with a cryptographically random value of the length required by the component
Remove the shipped example file from production hosts to prevent accidental reuse of the default value
Place the packet-analysis component behind a network access control that enforces authenticated administrator-only reachability

bash

# Configuration example
# Generate a cryptographically random signing secret and place it in the active configuration.
# Replace the placeholder path with the actual configuration file location for your deployment.

NEW_SECRET="$(openssl rand -hex 32)"
sed -i "s/^AUTH_COOKIE_SECRET=.*/AUTH_COOKIE_SECRET=${NEW_SECRET}/" /path/to/active/.env
chmod 600 /path/to/active/.env
# Restart the packet-analysis component to invalidate previously signed cookies