A flaw in the POST /openid/config endpoint of Actual Budget’s sync‑server exposes the entire OpenID Connect configuration, including the OAuth2 client_secret, to any caller who knows the bootstrap password. The endpoint has no authentication guard and lacks rate limiting, which renders the bootstrap password brute‑forceable. This results in a confidentiality breach that can expose credentials used for synchronizing personal finance data.

Actual Budget sync‑server versions 26.4.0 and earlier are affected. The problem is fixed in version 26.5.0. No other vendors or products are impacted by this specific flaw.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is a local attacker or an adversary who can reach the sync‑server over the network and brute‑force the bootstrap password to retrieve the exposed client_secret. The absence of rate limiting makes such brute‑force attacks feasible if the sync‑server is exposed to untrusted networks.