ThingsBoard versions up to 4.3.0.1 allow a remote attacker to bypass authentication during the OAuth authorization code exchange. The application improperly trusts user‑supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in the JSON payload, an attacker can impersonate any existing user and obtain full access to that account. This vulnerability results in a complete account takeover, compromising confidentiality, integrity, and availability of the platform, while affecting any user account whose credentials are not protected by additional safeguards.

The affected product is ThingsBoard, specifically version 4.3.0.1. No additional vendor or product variants are listed.

The CVSS score is 9.8, indicating a critical severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation observed in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote, via the OAuth 2.0 login endpoint. An attacker only needs to craft a modified JSON request containing a forged email address; the application will accept it as a legitimate user. With no authentication or checks on the supplied identity data, the attacker immediately gains all privileges associated with the target account.