Executive brief
Concrete CMS is a web content management system used to build and manage websites. Prior to version 9.5.3, the OAuth authentication callback failed to verify whether user accounts were active or email-validated before granting login access. An attacker with a deactivated or unvalidated OAuth-linked account could bypass these security checks, gain unauthorized session access, and perform actions as an authenticated user.
Technical details
The vulnerability exists in the OAuth callback login path, which implements an authentication bypass by failing to validate account status (active/inactive) and email validation state before session establishment. The attack vector is network-based with no privilege requirements and no user interaction needed beyond having an existing OAuth binding. An attacker with a deactivated or unvalidated account tied to an OAuth provider can authenticate successfully and receive a fully authenticated session with login events recorded. The vulnerability was patched in version 9.5.3 and is tracked as CVE-2026-81906 with a CVSS v4.0 score of 6.3.
Affected products
- Concrete CMS Concrete CMS prior to 9.5.3
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in version 9.5.3