Description

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T14:16:57.943Z",
  "pubdate": "2026-08-13T14:16:57.943Z",
  "executiveSummary": "An unauthenticated authentication bypass vulnerability has been identified in Headless Single Sign On versions 1.6 and below. This security flaw allows remote, unauthenticated threat actors to entirely circumvent authentication mechanisms implemented within the application. The primary impact of this vulnerability involves unauthorized access to protected resources and administrative functions, potentially leading to complete system compromise, unauthorized data exfiltration, and lateral movement within the network. The vulnerability resides in the core authentication handling logic of the affected product, where inadequate request validation permits the direct circumvention of session generation and credential verification routines. Exploitation requires network connectivity to the vulnerable endpoint hosting the Headless Single Sign On service, but does not necessitate prior authentication, valid user credentials, or specialized interaction from legitimate users. The risk implication is severe, as successful exploitation undermines the fundamental trust boundary of the identity and access management system, exposing all integrated applications and downstream services to unauthorized access. Organizations utilizing the affected versions face immediate exposure to targeted compromise and session hijacking attacks.",
  "technicalDetails": "The vulnerability is classified as an authentication bypass affecting Headless Single Sign On <= 1.6 versions. The root cause stems from improper validation of authentication tokens and request state within the core authentication component, allowing an unauthenticated remote attacker to supply specially crafted requests that manipulate the internal authorization flow.\nDuring standard operation, the Headless Single Sign On service validates incoming authentication requests against configured identity providers or internal credential stores before issuing a valid session token. However, due to flawed logic in the request routing and verification modules, an attacker can bypass these security checks entirely by omitting required authentication headers, supplying malformed parameters, or directly accessing restricted endpoints that fail to enforce proper access control checks.\nThe attack flow proceeds as follows: First, the attacker identifies the network-exposed endpoints associated with the Headless Single Sign On application. Second, the attacker sends an HTTP request designed to interact with protected API routes or authentication callback handlers without supplying valid credentials. Third, because the vulnerable component fails to correctly validate the session state or enforces improper fallback logic, the application treats the unauthenticated request as originating from a legitimate, authenticated context. Finally, the server responds by granting access to the requested resource, issuing a valid session identifier, or returning sensitive session data to the unauthorized entity.\nThe attack vector is network-based, exposing the vulnerability to any actor with IP reachability to the target service. The vulnerability requires zero privileges and no prior user interaction, significantly lowering the barrier to exploitation. Post-exploitation impact includes unauthorized impersonation of legitimate users, access to confidential enterprise data, privilege escalation across integrated systems, and potential manipulation of downstream administrative services dependent on the compromised single sign-on infrastructure."
}