CVE-2026-53912— Cerebrate self-registration password hash exposure via inbox and audit log views

Cerebrate self-registration password hash exposure via inbox and audit log views

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This payload was returned unredacted through inbox index and view responses, including HTML, JSON, and CSV outputs, and could also be written unredacted into audit log entries for the inbox message. An authenticated user with sufficient privileges to access inbox entries or related audit logs could retrieve password hashes associated with pending self-registration requests. Although the exposed value is a password hash rather than a plaintext password, disclosure of password hashes may enable offline password-cracking attempts and could increase risk where users reuse passwords across systems. Cerebrate 1.37 fixes the issue by redacting sensitive password and authkey fields from inbox display/API output and recursively redacting those fields from JSON values written to audit logs, while leaving the stored registration payload intact for account creation processing. Affected component: Inbox self-registration request handling and audit logging Fixed version: Cerebrate 1.37

N/A

信息暴露

Cerebrate 信息泄露漏洞

Cerebrate是Cerebrate开源的一个开源平台。旨在充当受信任的联系信息提供者和其他安全工具的互连协调器。 Cerebrate 1.37之前版本存在信息泄露漏洞，该漏洞源于自注册请求中暴露凭据材料。自注册工作流将注册者的哈希密码存储在收件箱消息数据负载中。该负载在收件箱索引和视图响应中未经过滤地返回，包括HTML、JSON和CSV输出，并且也可能未经过滤地写入收件箱消息的审计日志条目中。具有足够权限访问收件箱条目或相关审计日志的经过身份验证的用户可以检索与待处理自注册请求关联的密码哈希。尽管暴露

N/A

N/A