CVE-2026-14881 in Compass
Summary
by MITRE • 07/22/2026
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the Compass platform's connection import functionality, where improper input validation allows unauthorized modification of connection parameters during the import process. The flaw stems from insufficient sanitization of imported connection data, specifically enabling attackers to inject custom browser open commands for OIDC authentication flows that should normally be restricted to global configuration settings only. This represents a privilege escalation vulnerability where user-controlled input can bypass intended access controls and modify system-wide authentication behaviors. The technical implementation appears to lack proper parameter validation during the import operation, allowing arbitrary command injection through the connection options override mechanism.
The operational impact of this vulnerability is significant as it enables attackers to manipulate the OpenID Connect authentication flow by injecting malicious browser commands that could redirect users to phishing sites or execute unauthorized actions during the authentication process. This weakness directly violates the principle of least privilege and can lead to credential theft, session hijacking, or unauthorized access to protected resources within the Compass environment. The vulnerability specifically affects the authentication flow management where the system should enforce global settings but instead allows local overrides through import mechanisms.
From a cybersecurity perspective, this vulnerability maps to CWE-94 (Improper Control of Generation of Code) and CWE-79 (Cross-Site Scripting) categories, representing code injection and input validation failures. The ATT&CK framework categorizes this under T1059.001 (Command and Scripting Interpreter - PowerShell) and T1566 (Phishing) as attackers could leverage this to execute malicious commands or redirect users during authentication. The vulnerability also aligns with T1210 (Exploitation of Remote Services) when attackers exploit the import functionality to gain unauthorized access to system resources.
Mitigation strategies should include implementing strict input validation and sanitization for all imported connection parameters, enforcing role-based access controls on import operations, and restricting the ability to override global settings through local imports. The platform should validate that imported connection options cannot modify system-wide authentication behaviors and should implement proper parameter whitelisting for allowed configuration changes. Additionally, logging and monitoring of import operations should be enhanced to detect suspicious parameter modifications. Security patches must ensure that connection import functionality properly validates all input parameters against predefined security policies rather than accepting arbitrary overrides that could compromise the authentication system integrity.