Executive brief
Actual Budget is a personal finance tool that uses a synchronization server to manage user data. A security flaw in this server allows unauthorized individuals to retrieve sensitive configuration details, including secret keys used for identity management. An attacker could use this information to impersonate the application, potentially compromising user accounts or accessing private identity data.
Technical details
An incorrect authorization vulnerability exists in the `POST /openid/config` endpoint of Actual Budget's sync-server. The endpoint exposes the full OpenID Connect configuration, including the OAuth2 `client_secret`, to any user who provides the bootstrap password. However, the endpoint lacks proper authentication and rate limiting, making the bootstrap password susceptible to brute-force attacks. An attacker who successfully retrieves the `client_secret` can impersonate the Actual Budget application to the identity provider, enabling token exchange attacks. This issue is resolved in version 26.5.0.
Affected products
- Actual Budget Actual Budget sync-server <= 26.4.0
Timeline
- 2026-05-03: patched: Version 26.5.0 released
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD