Skip to content
Threat Feed

Product

Automad (>= 2.0.0-Alpha.1, <= 2.0.0-Beta.27)

1 brief RSS
high advisory

Automad Unauthenticated Exposure of Administrator Password Hashes and TOTP Secrets

Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27 are vulnerable to CVE-2026-45332, a Broken Access Control vulnerability that allows an unauthenticated attacker to retrieve bcrypt password hashes of administrator accounts using a single POST request to the `/_api/user-collection/create-first-user` endpoint, potentially leading to credential compromise and information disclosure.

Automad broken-access-control credential-access cve-2026-45332
2r 2t