# CVE-2022-36076: NodeBB account takeover via SSO plugins

Source: https://junglewise.ai/threats/cve-2022-36076-nodebb-account-takeover-via-sso-plugins  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-36076 · Severity: low · CVSS 3.1 · Published 2022-09-16

NodeBB is a forum and community platform software. A flaw in its single sign-on (SSO) authentication process could allow an attacker performing a man-in-the-middle (MITM) attack to intercept and hijack another user's login session, resulting in complete account takeover and unauthorized access to that user's account and data.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb).

## Quick answers

**Is CVE-2022-36076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-36076 being exploited in the wild.

**How severe is CVE-2022-36076?** Low severity, with a CVSS score of 3.1, published 16 September 2022.

**Which products and versions are affected?** NodeBB < 1.17.2.

**Is there a fix for CVE-2022-36076?** A patch was published on 2022-09-16: v1.17.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-36076 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2022-36076?** Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CSRF-like flaw (CWE-352) in NodeBB's SSO plugin authentication flow. A strict conditional in the first step of the SSO process inadvertently made nonce validation opt-in rather than opt-out, disabling CSRF protection that should always be active. An attacker positioned for a man-in-the-middle attack (e.g., on the network path) can craft a malicious request to /auth/callback with a valid authorization code to hijack another user's account. The attack requires user interaction (user must click a link or perform SSO login) and network adjacency or control. The vulnerability was patched in NodeBB v1.17.2 and later; affected versions are prior to 1.17.1.

## Affected products

- NodeBB NodeBB < 1.17.2

## Identifiers

- CVE-2022-36076
- GHSA-xmgg-fx9p-prq6

## Timeline

- 2022-09-01: disclosed
- 2022-09-16: patched: v1.17.2 released

## References

- [https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6](https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile)
- [NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs)