CVE-2026-72561 in Peppermint
Summary
by MITRE • 08/11/2026
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical broken access control flaw in the Peppermint Lab Peppermint platform that undermines fundamental security controls. The issue stems from insufficient authorization checks within the platform's configuration management system, specifically affecting the global OIDC/SSO settings endpoint. When examining this vulnerability through the lens of CWE classification, it aligns with CWE-285 which addresses improper authorization in software systems. The root cause lies in the absence of proper administrative role validation before allowing modifications to critical security parameters that govern single sign-on operations across the entire platform.
The technical implementation of this flaw manifests through an unprotected configuration endpoint that accepts OIDC issuer settings without verifying whether the requesting user possesses administrative privileges. This represents a classic privilege escalation vector where authenticated users can leverage their session to modify system-wide security configurations. The vulnerability exists within the commit referenced as ba6e217, indicating this was likely introduced during a specific code change that failed to implement proper access controls for configuration endpoints. From an operational perspective, this flaw is particularly dangerous because it allows attackers to redirect all platform authentication traffic through an attacker-controlled identity provider.
The impact of this vulnerability extends far beyond simple privilege escalation, creating a comprehensive credential harvesting attack vector that can compromise all platform users. When an attacker successfully modifies the OIDC settings, they can redirect authentication flows to malicious identity providers designed specifically to capture login credentials and tokens from unsuspecting users. This enables large-scale credential theft across the entire user base without requiring individual account compromises. The operational risk is compounded by the fact that this attack does not require administrative privileges to initiate, making it accessible to any authenticated user who may have legitimate access to the platform but lacks proper security clearance.
From a threat modeling perspective, this vulnerability maps directly to several ATT&CK techniques including T1566 for credential harvesting through social engineering and T1078 for valid accounts usage. The attack chain begins with an authenticated user accessing the unprotected endpoint, followed by configuration changes that redirect all SSO traffic, ultimately leading to credential capture at scale. Mitigation strategies must address both immediate remediation through proper access control implementation and long-term security architecture improvements. Organizations should implement role-based access controls with explicit administrative privilege checks before allowing modifications to critical security settings, ensuring that only designated administrators can modify global authentication configurations. Additionally, implementing monitoring and alerting on configuration changes for OIDC settings would provide early detection capabilities for unauthorized modifications that could indicate exploitation attempts.
The broader implications of this vulnerability highlight the importance of comprehensive security testing including authorization validation during development lifecycle phases. Security controls must be implemented at multiple layers and validated through proper penetration testing and code reviews. This case demonstrates how a single missing authorization check can create an attack vector with cascading effects across an entire platform's user base, emphasizing the need for systematic approaches to access control verification and security architecture reviews that ensure all configuration endpoints properly validate administrative privileges before allowing critical modifications.