Improper Authentication Vulnerability in Rebuild Login Endpoint

A security vulnerability (CVE-2026-102248) has been identified in the Rebuild application affecting versions up to 4.4.7 and 4.5.0-beta5. The flaw resides within the Login Endpoint located at /user/login. Attackers can remotely manipulate input sent to this endpoint to trigger an authentication bypass, potentially gaining unauthorized access to the application. Public exploit code for this vulnerability is currently available, increasing the risk of active exploitation. The vendor has not responded to disclosure efforts regarding this issue. Organizations using Rebuild are advised to assess their exposure to this endpoint, as it provides a direct vector for unauthenticated access.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to bypass the application's login mechanism. This can lead to unauthorized access to user accounts, data exposure, and potential administrative control over the application, depending on the privileges of the targeted account.

Recommendation

1. Implement strict access control lists or Web Application Firewall (WAF) rules to restrict access to /user/login if patching is not possible.
2. Audit web server logs for high-frequency or anomalous POST requests to the /user/login path.
3. Given the lack of a vendor response, monitor the Rebuild application for signs of unauthorized account access or unexpected administrative activity.