CVE-2026-42604

PENDING

N/A

CVSS Severity Score

EPSS Score0.1770%

EPSS Percentile12.54th

Published2026年6月12日

Last Modified2026年6月12日

Vulnerability Description

Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server versions <= 26.4.0 exposes the full OpenID Connect configuration—including the OAuth2 `client_secret`—to any caller who knows the bootstrap password. The endpoint also lacks authentication and rate limiting, making the bootstrap password brute-forceable. Version 26.5.0 fixes the issue.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://actualbudget.org/blog/release-26.5.0

🔗 https://github.com/actualbudget/actual/security/advisories/GHSA-49v6-pqjq-xw55

Vulnerability Description

Affected Platforms (CPE)

References & Advisories

関連する脆弱性情報