CVE Intelligence
Analysis AI-assisted

CVE-2026-25519: OpenSlides: improper access control allows local login by SAML-synced users with a shared trivial password

OpenSlides, a web-based presentation and assembly system, has an improper access control issue affecting users synced through an external SAML identity provider. According to the record, the local login form accepted the OpenSlides username of a SAML user with a trivial password that was valid for all such users. NVD rates it critical with a CVSS 3.1 base score of 9.8, and the record states it is fixed in version 4.2.29.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes CVE-2026-25519 in OpenSlides, a web-based presentation and assembly system. Before version 4.2.29, users synced from an external SAML identity provider could sign in through the local login form using only their OpenSlides username together with a trivial password, and that password was accepted for all SAML users.

Impact

  • The record classifies the flaw as improper access control (CWE-284).
  • NVD assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact with no privileges required.
  • GitHub lists a separate CVSS 3.1 score of 8.1.
  • The practical consequences depend on the data and assemblies managed in each instance. The record does not describe specific data exposure.

Affected products and versions

  • Product: OpenSlides (listed in the record as Openslides Openslides).
  • Range in the record: from 4.2.5 up to, but not including, 4.2.29.
  • The fix is in 4.2.29, according to the record and the vendor release tag.
  • The record does not state whether versions outside this range are affected.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade OpenSlides to version 4.2.29 or later, as the patch references indicate.
  • The record also references a patch commit in the openslides-auth-service repository. Review the vendor advisory to confirm which components must be updated in your deployment.
  • Until the upgrade is applied, consider restricting local login for accounts that are provisioned through SAML. This is a general defensive recommendation, not a documented vendor workaround.
  • Review authentication logs for local logins by SAML-synced accounts that were not expected.

Detection guidance

  • Monitor local login events for accounts that are normally authenticated through SAML.
  • Correlate successful local logins with identity provider records, since a SAML-synced user should not normally hold a local session.
  • Raise alerts for local logins to administrative accounts that come from unusual sources or times.

Limitations of the available information

  • The source record has no title, so the title in this analysis was written from the description.
  • The record does not state whether local login is enabled by default or how widely the SAML integration is deployed.
  • The EPSS score and SSVC data are missing.
  • The vendor advisory was not reviewed beyond the record, so any extra details it contains are not reflected here.

Frequently asked questions

Is CVE-2026-25519 being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which OpenSlides versions are affected?

The record lists versions from 4.2.5 up to, but not including, 4.2.29. Upgrading to 4.2.29 or later is the fix referenced by the sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.