CVE-2026-102248

Rebuild Login Endpoint login improper authentication

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability is an improper authentication flaw in the Rebuild Login Endpoint. An attacker can manipulate the login process to bypass authentication checks, matching CWE-287. This manipulation allows an attacker to gain unauthorized access to the application and potentially elevate privileges within the system.

Affected Systems

Rebuild versions up to 4.4.7 and the beta release 4.5.0‑beta5 contain the flaw. The affected code lies in the /user/login component of the Login Endpoint. No other versions have been reported as affected.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The EPSS score is unavailable, but the vulnerability is publicly exploitable and can be triggered remotely. It is not listed in the CISA KEV catalog, and the vendor has not issued a patch, so the risk remains significant until a newer release is deployed.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Rebuild to a version newer than 4.4.7/4.5.0‑beta5 and apply any vendor patches as they become available
  • If an upgrade is not immediately possible, limit access to the /user/login endpoint through network controls or a reverse proxy, allowing only trusted internal traffic
  • Enable multi‑factor authentication for all user accounts to add an extra barrier against credential manipulation
  • Continuously monitor authentication logs for repeated or anomalous login attempts

Generated by OpenCVE AI on September 29, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Rebuild Login Endpoint login improper authentication
First Time appeared Rebuild
Rebuild rebuild
Weaknesses CWE-287
CPEs cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:*
Vendors & Products Rebuild
Rebuild rebuild
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 5:00 PM
Reserved
Sep 28, 2026, 7:04 PM

View source JSON

Updated
Sep 29, 2026, 5:00 PM

JSON

Status
Deferred
Published
Sep 29, 2026, 4:17 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 29, 2026, 7:30 AM

JSON