Automad CVE-2026-45332 Unauthenticated Admin Password Hash and TOTP Secret Exposure

Vulnerability Overview Vulnerability Name: Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint Vulnerability Type: Broken Access Control Severity: High (7.5/10) CVE ID: CVE-2026-45332 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None Affected Versions Affected Versions: - bcrypt hash exposure: >= 2.0.0-alpha.1, <= 2.0.0-beta.27 - TOTP secret exposure: only 2.0.0-beta.27 Vulnerability Description: - A Broken Access Control vulnerability allows an unauthorized attacker to retrieve the bcrypt password hash for every administrator account with a single POST request. - The endpoint remains publicly accessible after initial configuration and returns full serialized user data in the JSON response body. - The related vulnerability implementation code is located in the and files. Remediation Fixed Version: 2.0.0-beta.28 or later Remediation Measures: - Update to the fixed version to resolve this issue. - This issue was privately reported and fixed prior to public disclosure. Proof of Concept (PoC) Example Response Impact Potential Impact: - Credential Hash Exposure: Enables offline brute-force or dictionary attacks. - TOTP Secret Exposure: The TOTP secret is included in the response, potentially leading to two-factor authentication bypass. - Information Disclosure: The response reveals absolute file paths, which may expose environment-specific information. Additional Information Reporter: lorenzocamilli Disclosure Date: 3 weeks ago Package Information: - Package Name: automad/automad (Composer) - Affected Versions: 2.0.0-alpha.1 - 2.0.0-beta.27 - Fixed Version: 2.0.0-beta.28

Goal Reached Thanks to every supporter — we hit 100%!

Automad CVE-2026-45332 Unauthenticated Admin Password Hash and TOTP Secret Exposure

More from this source