Cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3arebuildrebuild/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 29 Sep 2026 04:25:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Authentication Vulnerability in Rebuild Login Endpointhttps://feed.craftedsignal.io/briefs/2026-09-rebuild-auth-bypass/Tue, 29 Sep 2026 04:25:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-rebuild-auth-bypass/Rebuild versions up to 4.4.7 and 4.5.0-beta5 are vulnerable to an improper authentication flaw in the login component that permits remote attackers to bypass authentication via manipulated requests.A security vulnerability (CVE-2026-102248) has been identified in the Rebuild application affecting versions up to 4.4.7 and 4.5.0-beta5. The flaw resides within the Login Endpoint located at /user/login. Attackers can remotely manipulate input sent to this endpoint to trigger an authentication bypass, potentially gaining unauthorized access to the application. Public exploit code for this vulnerability is currently available, increasing the risk of active exploitation. The vendor has not responded to disclosure efforts regarding this issue. Organizations using Rebuild are advised to assess their exposure to this endpoint, as it provides a direct vector for unauthenticated access.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to bypass the application's login mechanism. This can lead to unauthorized access to user accounts, data exposure, and potential administrative control over the application, depending on the privileges of the targeted account.

Recommendation

  1. Implement strict access control lists or Web Application Firewall (WAF) rules to restrict access to /user/login if patching is not possible.
  2. Audit web server logs for high-frequency or anomalous POST requests to the /user/login path.
  3. Given the lack of a vendor response, monitor the Rebuild application for signs of unauthorized account access or unexpected administrative activity.
]]>highthreatauthentication-bypassweb-vulnerabilitycve-2026-102248web-applicationauthorization-bypasscve-2026-102249