Executive brief
ThingsBoard, an open-source IoT platform, contains a security flaw in its login system. An attacker can bypass the normal login process and take over any user account, including administrative accounts, simply by providing a target's email address during a specific login sequence. This allows unauthorized access to sensitive IoT data, device controls, and system configurations without needing the victim's password.
Technical details
An authentication bypass exists in ThingsBoard v4.3.0.1 due to improper validation of user-supplied identity data during the OAuth 2.0 flow. Specifically, the `/login/oauth2/code/` endpoint improperly trusts the `user` parameter within the JSON request body. A remote, unauthenticated attacker can intercept an OAuth login request (such as 'Sign in with Apple') and inject a `user` field containing a victim's email address. The server processes this manipulated request and issues a JWT access token for the victim's account instead of the attacker's. This allows for full account takeover without knowledge of the target's credentials. The issue is addressed in versions 4.2.2.1 and 4.3.1.1.
Affected products
- ThingsBoard ThingsBoard v4.3.0.1
Timeline
- 2026-06-10: other: PoC activity recorded
- 2026-06-15: disclosed: CVE published to NVD
- 2026-06-15: advisory