# CVE-2026-104108: FileRise OIDC authentication bypass via mutable claims

Source: https://junglewise.ai/threats/cve-2026-104108-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-104108 · Severity: high · CVSS 8.1 · Published 2026-10-14

FileRise is a self-hosted web-based file manager. Prior to version 3.23.0, an attacker who can obtain forged or manipulated identity provider claims can bypass authentication and log in as an existing user, including the administrator account, by exploiting how FileRise maps mutable username and email claims to local accounts. This could allow unauthorized access to all files and administrative functions.

Technologies: [Filerise](https://junglewise.ai/threats/technologies/filerise-filerise). Vendors: [Filerise](https://junglewise.ai/threats/vendors/filerise).

## Quick answers

**Is CVE-2026-104108 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104108 being exploited in the wild.

**How severe is CVE-2026-104108?** High severity, with a CVSS score of 8.1, published 14 October 2026.

**Which products and versions are affected?** Filerise prior to 3.23.0.

**Is there a fix for CVE-2026-104108?** Yes: fixed in 3.23.0. Until then: Before upgrading to 3.23.0, verify a working local administrator login and back up the users directory. On first OIDC login after upgrade, existing accounts will be prompted to confirm their local password to establish the immutable issuer-subject binding; new OIDC identities without local account collisions auto-provision normally. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104108 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104108?** Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.23.0

Before upgrading to 3.23.0, verify a working local administrator login and back up the users directory. On first OIDC login after upgrade, existing accounts will be prompted to confirm their local password to establish the immutable issuer-subject binding; new OIDC identities without local account collisions auto-provision normally.

## Technical details

FileRise maps authenticated OIDC identity claims to local accounts using mutable preferred_username or email claims without requiring email_verified validation, allowing claim collision attacks. An attacker with access to provider-issued claims (via provider compromise, misconfiguration, or provider-specific weaknesses) can craft colliding claims that match an existing local username to gain that account's privileges, including administrator access. The fix in 3.23.0 binds accounts to immutable issuer-and-subject identities and rejects unverified email claims for account naming.

## Affected products

- FileRise FileRise prior to 3.23.0

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a](https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a)
- [https://github.com/error311/FileRise/releases/tag/v3.23.0](https://github.com/error311/FileRise/releases/tag/v3.23.0)

## Related threats

- [FileRise weak default encryption key in pristine installations](https://junglewise.ai/threats/cve-2026-77427-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise privilege escalation in remember-me token handling](https://junglewise.ai/threats/cve-2026-57493-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to…](https://junglewise.ai/threats/cve-2025-66403-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version…](https://junglewise.ai/threats/cve-2025-62510-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to…](https://junglewise.ai/threats/cve-2025-62509-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)