CVE-2026-72561

CVE-2026-72561 exposes a configuration endpoint in OIDC/SSO infrastructure that validates authentication but does not enforce explicit authorization. Any authenticated user — regardless of privilege level — can modify the identity provider settings. This is not a subtle access control edge case; it is a missing role check on a sensitive administrative function. The vulnerability sits in what security practitioners call the authentication-authorization gap. Developers built the endpoint assuming that 'authenticated access' equals 'admin trust,' a mental model that emerges predictably when configuration tools are built during initial platform setup and rarely revisited. The OIDC configuration page isn't user-facing, so it doesn't receive the same security scrutiny as login flows. The implicit reasoning becomes: 'Only admins will ever touch this.' The practical impact is severe. Modifying the IdP configuration redirects authentication to an attacker-controlled provider. Every subsequent login — across the entire user base — automatically submits credentials to the attacker's infrastructure. This is not a single compromised session; the platform's entire authentication layer becomes a credential harvesting mechanism. You cannot detect this through user behavior because the login appears completely legitimate. You cannot rotate your way out of it because every new credential is intercepted. The CVSS 8.8 rating underweights the persistence dimension. Once the attacker controls the IdP, they maintain access even after the endpoint is patched — harvested credentials remain valid, and the IdP configuration could be restored. Recovery requires reconstructing authentication state you no longer have access to, which is operationally expensive and may result in permanent loss of the original IdP settings. What to check: Review whether your RBAC system is consistently applied across ALL administrative endpoints, or if other configuration functions exhibit the same authentication-without-authorization pattern. The question is not whether one check was missed, but whether your platform has a systemic gap in role-based access control enforcement for infrastructure-level configuration.

Reviewed through automated stages and approved by a human before publication.