Executive brief
Digital-Infrastructure is an enterprise identity and access management platform used to control employee authentication and permissions across organizations. A critical flaw in its Single-Sign On (SSO) component allows attackers to log in as any user—including administrators—without knowing their password, potentially granting full control over the system and access to sensitive organizational data.
Technical details
The vulnerability exists in the Y9AuthenticationHandler.authenticate method, which handles SSO logins. When a login request specifies loginType=qrCode, the handler retrieves a user by personId without verifying any password or QR-code state, bypassing the bcryptMatch validation required for other login types. The attacker can obtain the RSA public key from the unauthenticated /sso/api/getRsaPublicKey endpoint, use it to encrypt a known personId (which may be leaked via other application flaws), and submit a forged qrCode-type login request. Since there are no tenant restrictions or QR-code state checks, authentication succeeds immediately. The flaw affects Digital-Infrastructure v9.6.7 and earlier; patches or mitigations are not yet confirmed in the advisory.
Affected products
- Risesoft Digital-Infrastructure 9.6.7 and earlier
Timeline
- 2026-09-08: disclosed