# CVE-2026-79576: Digital-Infrastructure SSO authentication bypass

Source: https://junglewise.ai/threats/cve-2026-79576-digital-infrastructure-sso-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79576 · Severity: critical · CVSS 9.8 · Published 2026-09-08

Digital-Infrastructure is an enterprise identity and access management platform used to control employee authentication and permissions across organizations. A critical flaw in its Single-Sign On (SSO) component allows attackers to log in as any user—including administrators—without knowing their password, potentially granting full control over the system and access to sensitive organizational data.

Technologies: [Risesoft Digital-Infrastructure](https://junglewise.ai/threats/technologies/digital-infrastructure). Vendors: [Risesoft](https://junglewise.ai/threats/vendors/risesoft).

## Quick answers

**Is CVE-2026-79576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79576 being exploited in the wild.

**How severe is CVE-2026-79576?** Critical severity, with a CVSS score of 9.8, published 8 September 2026.

**Which products and versions are affected?** Risesoft Digital-Infrastructure 9.6.7 and earlier.

**Is there a fix for CVE-2026-79576?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79576 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79576?** Check whether you run Risesoft Digital-Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Y9AuthenticationHandler.authenticate method, which handles SSO logins. When a login request specifies loginType=qrCode, the handler retrieves a user by personId without verifying any password or QR-code state, bypassing the bcryptMatch validation required for other login types. The attacker can obtain the RSA public key from the unauthenticated /sso/api/getRsaPublicKey endpoint, use it to encrypt a known personId (which may be leaked via other application flaws), and submit a forged qrCode-type login request. Since there are no tenant restrictions or QR-code state checks, authentication succeeds immediately. The flaw affects Digital-Infrastructure v9.6.7 and earlier; patches or mitigations are not yet confirmed in the advisory.

## Affected products

- Risesoft Digital-Infrastructure 9.6.7 and earlier

## Timeline

- 2026-09-08: disclosed

## References

- [https://github.com/fangtang7/CVE/blob/main/Digital-Infrastructure/sso.md](https://github.com/fangtang7/CVE/blob/main/Digital-Infrastructure/sso.md)

## Related threats

- [Risesoft Digital-Infrastructure missing authorization in log DownloadController](https://junglewise.ai/threats/cve-2026-111651-risesoft-digital-infrastructure-through-9-6-11-contains-a)
- [Risesoft-y9 Digital-Infrastructure path traversal in fileManager](https://junglewise.ai/threats/cve-2026-110116-risesoft-y9-digital-infrastructure-9-6-5-through-9-6-11-contains)
- [Risesoft Digital-Infrastructure path traversal in file manager](https://junglewise.ai/threats/cve-2026-110115-risesoft-digital-infrastructure-9-6-5-through-9-6-11-contains-a)