Is CVE-2026-42604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42604 being exploited in the wild.

How severe is CVE-2026-42604?

Informational severity, with a CVSS score of 6.9, published 12 June 2026.

Which products and versions are affected?

Actual Budget Sync Server <= 26.4.0.

Is there a fix for CVE-2026-42604?

A patch was published on 2026-05-03: Version 26.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42604 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42604?

Check whether you run Actual Budget Sync Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42604: Actual Budget sync-server information disclosure in OpenID config

Q: Is there a fix for CVE-2026-42604?

A patch was published on 2026-05-03: Version 26.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42604 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-42604?

Check whether you run Actual Budget Sync Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42604 · Severity: info · CVSS 6.9 · Published 2026-06-12

Actual Budget is a personal finance tool that uses a synchronization server to manage user data. A security flaw in this server allows unauthorized individuals to retrieve sensitive configuration details, including secret keys used for identity management. An attacker could use this information to impersonate the application, potentially compromising user accounts or accessing private identity data.

Technologies: Actual Budget Sync Server. Vendors: Actual Budget.

Quick answers

Is CVE-2026-42604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42604 being exploited in the wild.
How severe is CVE-2026-42604?: Informational severity, with a CVSS score of 6.9, published 12 June 2026.
Which products and versions are affected?: Actual Budget Sync Server <= 26.4.0.
Is there a fix for CVE-2026-42604?: A patch was published on 2026-05-03: Version 26.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42604 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42604?: Check whether you run Actual Budget Sync Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability exists in the `POST /openid/config` endpoint of Actual Budget's sync-server. The endpoint exposes the full OpenID Connect configuration, including the OAuth2 `client_secret`, to any user who provides the bootstrap password. However, the endpoint lacks proper authentication and rate limiting, making the bootstrap password susceptible to brute-force attacks. An attacker who successfully retrieves the `client_secret` can impersonate the Actual Budget application to the identity provider, enabling token exchange attacks. This issue is resolved in version 26.5.0.

Affected products

Actual Budget Actual Budget sync-server <= 26.4.0

Timeline

2026-05-03: patched: Version 26.5.0 released
2026-05-26: advisory: GitHub Security Advisory published
2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.