CVE-2026-92808 in Altium
Summary
by MITRE • 09/16/2026
A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself.
One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the UnifiedLogin service of Altium Enterprise Server represents a critical server-side request forgery flaw that allows unauthenticated attackers to manipulate outbound network traffic initiated by the application itself. This type of attack exploits the trust relationship between an internal web service and its host, enabling remote adversaries to bypass local access controls by forcing the server to make requests on their behalf. The core technical failure lies in the insufficient validation of user-supplied input used to construct URLs or endpoints for outbound HTTP connections. By injecting maliciously crafted parameters into the UnifiedLogin workflow, a network attacker can direct the server process to communicate with arbitrary destinations, including internal services that are typically isolated from external networks and accessible only via localhost or private IP ranges. This mechanism effectively turns the vulnerable application into a proxy, allowing the attacker to interact with backend infrastructure as if they were originating from within the trusted environment of the server itself.
The operational impact of this vulnerability is severe due to its ability to facilitate credential theft and subsequent administrative takeover. The specific internal service targeted in this exploitation chain exposes sensitive configuration data and stored credentials without requiring authentication, relying solely on the assumption that requests originate locally from the application process. Because the forged SSRF request originates directly from the server's own network stack, it successfully satisfies this local-only security check. Consequently, an unauthenticated attacker can retrieve these plaintext or weakly protected credentials. With access to administrative-level credentials obtained through this vector, the attacker can authenticate into the system and gain full control over the Altium Enterprise Server instance. This results in a complete compromise of the server environment, potentially leading to unauthorized modification of configurations, data exfiltration, and lateral movement within the internal network where the server resides.
From a classification perspective, this vulnerability aligns with CWE-918, which defines Server-Side Request Forgery (SSRF), specifically involving the exploitation of backend systems that lack proper input validation for outbound requests. The attack technique is consistent with MITRE ATT&CK tactic T1557, known as Adversary-in-the-Middle or Lateral Tool Transfer via SSRF, where the attacker uses a compromised service to pivot into other parts of the network. Furthermore, the retrieval of credentials without authentication relates closely to CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. The severity is amplified by the fact that no prior authentication is required to trigger the initial SSRF payload, making it accessible to any actor with basic network connectivity to the affected service port.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Altium has addressed this issue in updated releases of Enterprise Server; therefore, applying the latest security patches provided by the vendor is the primary corrective action for existing deployments. For organizations unable to patch immediately, network segmentation should be enforced to ensure that internal services containing sensitive configuration data are not reachable from the server hosting the UnifiedLogin service, even if they reside on the same host. Implementing strict egress filtering rules can also limit the domains and IP addresses the application is permitted to contact, thereby reducing the attack surface for SSRF exploitation. Additionally, developers should implement a deny-list or allow-list approach for outbound URL validation, ensuring that only explicitly approved internal endpoints are accessible via programmatic requests. It is important to note that Altium 365 cloud deployments remain unaffected by this specific vulnerability because the vulnerable endpoint responsible for exposing local credentials is disabled in their cloud architecture, highlighting the importance of environment-specific configuration reviews when assessing risk.