CVE-2026-49229: @actual-app/sync-server - Session Tokens Allow Disabled OpenID Users Continued Access
Summary
CVE-2026-49229: @actual-app/sync-server: Disabled OpenID users keep access through existing session tokens. Affects @actual-app/sync-server versions < 26.6.0. Fixed in 26.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @actual-app/sync-server package is designed to facilitate synchronization services for applications using OpenID for user authentication. It supports multi-user environments, allowing users to log in and access various features securely. However, a critical vulnerability exists that permits disabled users to retain access through existing session tokens, undermining the intended security measures.
Vulnerability Detail
In OpenID multi-user mode, when an administrator disables a user, the action only prevents future logins for that user. Existing session tokens remain valid, allowing the disabled user to continue accessing authenticated server endpoints. The vulnerability arises because the session validation process does not check if the user account is enabled, leading to unauthorized access. This issue is exacerbated by the default token expiration setting of 'never', which means that disabled users can maintain access indefinitely until their session tokens are manually revoked or expire.
How To Fix
Latest published version: 26.10.0 as of 23 Oct 2026
npm install @actual-app/sync-server@26.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.6.0
This is the first release that contains the fix.
npm install @actual-app/sync-server@26.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually revoke existing session tokens for disabled users by implementing a session management strategy that deletes or invalidates tokens upon user account changes. This can be done by modifying the session management logic to include checks for user status.
Conclusion
The vulnerability identified as CVE-2026-49229 in the @actual-app/sync-server package poses a significant risk by allowing disabled users to maintain access through existing session tokens. It is crucial to update to the patched version and implement proper session management to mitigate this risk.
See every vulnerability recorded for @actual-app/sync-server →
FAQ
The vulnerability allows disabled OpenID users to retain access to their accounts through existing session tokens, even after their accounts have been disabled by an administrator.
Disabled users can access sensitive information and perform actions on their accounts, including financial data and administrative functions, until their session tokens are revoked or expire.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.3, indicating a high severity level.
Regularly update your dependencies and implement session management practices that ensure user status is checked before granting access to authenticated endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for @actual-app/sync-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
