CVE-2026-102248 Details

An authentication bypass vulnerability has been identified in the Rebuild application, specifically in versions through 4.4.7 and 4.5.0-beta5. The issue resides in the login endpoint, where the application improperly validates tokens. This vulnerability allows remote attackers to exploit the login mechanism by using public share tokens to gain unauthorized access as an administrator. The flaw arises because the application fails to enforce strict validation of token types and their intended purposes, enabling the reuse of tokens from public sharing contexts as login credentials.

To address this vulnerability, Rebuild should implement strict validation for tokens used in authentication processes. This includes separating token types for public sharing and login, binding tokens to their specific security contexts, and requiring proper authentication before granting administrative access. Additionally, any tokens exposed through the vulnerability should be revoked, and security audits should be conducted to ensure the issue is fully resolved.