The vulnerability is an authentication bypass that allows unauthenticated users to initiate the OpenID Connect login flow even when the application’s OIDC_ENABLED flag is set to false. By sending a HTTP GET to /auth/oidc/login, the server responds with a 302 redirect, sets an oidc_state cookie, and forwards the request to the configured OIDC provider. Because the /auth/oidc/enabled endpoint correctly reports the flag, the flaw is not evident through normal diagnostic checks. The flaw enables an attacker to obtain a valid session token through the external OIDC provider and thereby gain authorized access to the protected resources of Tugtainer. The weakness is an improper authorization check (CWE‑284).

Quenary Tugtainer prior to version 1.30.3 is affected. The application is a self‑hosted Docker container management web tool. Users running any version older than 1.30.3 with OIDC disabled retain this vulnerability.

With a CVSS score of 9.4 the flaw is considered critical. No EPSS data is available, but the lack of any listed KEV status does not diminish the potential impact. An attacker can remotely exploit the flaw simply by sending a crafted HTTP request to the /auth/oidc/login endpoint; no credentials or privileged access are required. The vulnerability is exploitable from any location that can reach the Tugtainer service, thus presenting a wide attack surface. Continuous monitoring for unexpected OIDC redirects and the presence of the oidc_state cookie can help detect abuse.