Executive brief
Peppermint is an open-source issue tracking and help desk platform. A vulnerability allows any logged-in user (even non-administrators) to reconfigure the platform's Single Sign-On (SSO) settings. An attacker could redirect all user logins to a fake identity provider, capturing credentials and compromising every user account on the platform.
Technical details
This is a broken access control vulnerability (CWE-639) in Peppermint's OIDC/SSO configuration endpoint. The endpoint fails to perform role-based authorization checks before processing requests to modify global OIDC issuer settings. Any authenticated user can send a request to reconfigure the OIDC issuer URL, bypassing the administrative role requirement. An attacker needs only a valid user account on the platform (no special privileges required). The vulnerability allows credential harvesting by redirecting SSO logins to an attacker-controlled identity provider, potentially compromising all platform users. The affected code is in commit ba6e217 and earlier versions.
Affected products
- Peppermint Lab Peppermint through commit ba6e217
Timeline
- 2026-08-11: disclosed
- 2026-07-17: other: Repository archived by owner on July 17, 2026