CVE-2026-79576 – Authentication Bypass (Any-User/Admin Impersonation) – risesoft-y9 Digital-Infrastr

Summary

CVE-2026-79576 is a critical authentication bypass vulnerability in the Single Sign-On (SSO/CAS) component of Digital-Infrastructure (risesoft-y9), an open-source unified identity and organizational management platform used by government and enterprise digital transformation deployments. The flaw allows a remote, unauthenticated attacker to log in as any user—including the Admin account—without knowledge of a password. The issue is rated CVSS 9.8 (Critical).

Technical details

• Root cause: A logic flaw in Y9AuthenticationHandler.authenticate(). When the login request specifies loginType=qrCode, the handler looks up the target account via findByPersonIdAndOriginal() using the supplied personId and returns that user as authenticated without ever validating a password (unlike the standard login path, which performs bcrypt verification). The lookup also applies no tenant restriction and does not verify any QR-code/UUID session state, so the "QR login" code path can be abused as a full bypass for any account.
• Trigger conditions / attack chain:
  1. Retrieve the SSO RSA public key from the unauthenticated endpoint /sso/api/getRsaPublicKey.
  2. Obtain a fresh CAS execution token from the login page.
  3. RSA-OAEP(SHA-256)-encrypt the target victim’s personId (obtainable via enumeration or other information disclosure) and base64-encode it.
  4. Submit the encrypted personId as both the username and password fields, with loginType=qrCode, to the CAS login endpoint.
  5. The server issues a valid CAS Service Ticket (ST) and TGC session cookie for the target account without ever checking a password.
  6. The attacker validates the ST to obtain an authenticated session as the victim (e.g., an administrator).
• Attack vector: Network, no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N).
• Impact: Complete authentication bypass and account takeover, including administrative accounts, resulting in full compromise of confidentiality, integrity, and availability of the platform and any connected downstream applications relying on this SSO/CAS instance.

Affected software

• risesoft-y9 Digital-Infrastructure (数字底座), version 9.6.7 and earlier (documented as affected up to and including 9.6.7).

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CISA ADP SSVC assessment notes a public proof-of-concept exists, the exploit is automatable, and the technical impact is total.

Mitigation and recommended actions

• Immediate: No official patched release or vendor security advisory has been published for this issue as of this writing. Organizations running Digital-Infrastructure should monitor the vendor’s GitHub repository for a fix and upgrade as soon as a corrected release is available.
• If no patch is available:
  • Disable or restrict the QR-code login (loginType=qrCode) path in the CAS/SSO handler until a fix is released, if the deployment does not require it.
  • Restrict network access to the SSO/CAS login endpoints and the /sso/api/getRsaPublicKey endpoint to trusted networks (e.g., via VPN or IP allow-listing) to reduce exposure to internet-based attackers.
  • Monitor authentication logs for anomalous CAS logins using the qrCode login type, especially resulting in administrative sessions.
  • Rotate credentials and session tokens for administrative and high-privilege accounts if compromise is suspected.
  • Enforce additional compensating controls such as multi-factor authentication or an authenticating reverse proxy in front of the SSO service where feasible.

References

• CVE-2026-79576 at NVD
• CVE-2026-79576 CVE Record (CVEProject/cvelistV5)
• Proof-of-Concept / Technical Writeup (SSO Authentication Bypass)