{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/openauth.net/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-78829"},{"id":"CVE-2026-78830"},{"id":"CVE-2026-78831"},{"id":"CVE-2026-78832"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MaxKey (4.x)","MCMS (6.1.1)","OpenAuth.Net (\u003c= 8.3.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Dromara","mingSoft","OpenAuth.Net"],"content_html":"\u003cp\u003ePublic technical disclosures and proof-of-concept reproduction steps have been released for four CVEs affecting Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net. The vulnerabilities include reflected and stored XSS, unauthenticated password modification, and sensitive information disclosure. A complete unauthenticated takeover chain was identified for OpenAuth.Net, potentially leading to RCE through an additional unauthenticated file upload capability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain-openauthnet\"\u003eAttack Chain (OpenAuth.Net)\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker calls \u003ccode\u003e/api/dynamic/GetList\u003c/code\u003e (CVE-2026-78832) without authentication to dump the \u003ccode\u003eSysUser\u003c/code\u003e table.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves plaintext administrative credentials from the dumped user data.\u003c/li\u003e\n\u003cli\u003eAttacker uses obtained credentials or the \u003ccode\u003e/api/dynamic/Invoke\u003c/code\u003e endpoint (CVE-2026-78831) to perform unauthorized password changes.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the administrative interface using the compromised account.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the unauthenticated \u003ccode\u003e/api/Files/Upload\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious file to achieve remote code execution.\u003c/li\u003e\n\u003cli\u003eAttacker optionally calls \u003ccode\u003e/api/dynamic/Delete\u003c/code\u003e to remove audit logs for anti-forensics.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDromara MaxKey 4.x: Reflected XSS enables admin session or JWT theft.\u003c/li\u003e\n\u003cli\u003emingSoft MCMS 6.1.1: Stored XSS allows malicious script injection via file uploads.\u003c/li\u003e\n\u003cli\u003eOpenAuth.Net \u0026lt;= 8.3.4: Critical exposure allows full unauthenticated system takeover, data exfiltration, and arbitrary code execution.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net to versions addressing these vulnerabilities immediately.\u003c/li\u003e\n\u003cli\u003eFor OpenAuth.Net, enforce strict authentication and authorization checks on all \u003ccode\u003e/api/dynamic/*\u003c/code\u003e and \u003ccode\u003e/api/Files/Upload\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eInspect web server logs for high volumes of requests to the \u003ccode\u003e/api/dynamic/\u003c/code\u003e path and unknown file uploads to \u003ccode\u003e/api/Files/Upload\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eValidate that no unauthorized users have been created or modified via administrative API endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T21:24:35Z","date_published":"2026-10-29T21:24:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-multiple-vulnerabilities-dromara-mingsoft-openauth/","summary":"Multiple unauthenticated vulnerabilities were disclosed across Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net, including XSS, information disclosure, and account takeover paths.","title":"Multiple Vulnerabilities in Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net","url":"https://feed.craftedsignal.io/briefs/2026-10-multiple-vulnerabilities-dromara-mingsoft-openauth/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenAuth.Net","version":"https://jsonfeed.org/version/1.1"}