CVE-2026-45332: Automad Unauthenticated Access to Administrator Password Hashes and TOTP Secrets
Summary
CVE-2026-45332: A Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. Affects automad/automad versions >= 2.0.0-alpha.1, < 2.0.0-beta.28. Fixed in 2.0.0-beta.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Automad is an open-source content management system that allows users to create and manage websites easily. It is designed for simplicity and efficiency, utilizing a flat-file architecture without the need for a database. However, a significant vulnerability has been identified that exposes sensitive information, including bcrypt password hashes and TOTP secrets, due to improper access controls.
Vulnerability Detail
The vulnerability arises from a broken access control mechanism in Automad, specifically through the publicly accessible API endpoint '/_api/user-collection/create-first-user'. This endpoint allows unauthenticated attackers to retrieve the bcrypt password hashes of all administrator accounts with a single POST request. The affected versions are between 2.0.0-alpha.1 and 2.0.0-beta.27 for bcrypt hash exposure, and only version 2.0.0-beta.27 for TOTP secret exposure. The implications of this vulnerability include the potential for offline brute-force attacks on passwords, bypassing two-factor authentication, and disclosing sensitive filesystem paths.
How To Fix
Minimum fixed version
2.0.0-beta.28
This is the first release that contains the fix.
composer require automad/automad:2.0.0-beta.28Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the API endpoint by implementing firewall rules or server configurations that limit access to trusted IP addresses only. Additionally, consider disabling the endpoint if it is not needed for your application.
Conclusion
In summary, the Automad vulnerability CVE-2026-45332 poses a significant risk by allowing unauthorized access to sensitive administrator information. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for automad/automad →
FAQ
The vulnerability allows unauthenticated users to access sensitive information, including bcrypt password hashes and TOTP secrets, through a publicly accessible API endpoint.
Affected versions include Automad versions >= 2.0.0-alpha.1 and <= 2.0.0-beta.27 for bcrypt hash exposure, and only version 2.0.0-beta.27 for TOTP secret exposure.
The risks include credential hash exposure, which can lead to offline brute-force attacks, bypassing two-factor authentication, and information disclosure about the server's filesystem structure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for automad/automad.
