External risk intelligence

Digital-Infrastructure SSO Component Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79576

The vulnerability exists in a Single-Sign On (SSO) component. SSO systems are designed to be internet-facing or widely accessible across networks to provide centralized authentication services for web applications, making them public-facing by design in normal deployment patterns.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7, allowing unauthenticated attackers to impersonate any user, including administrators, without needing a password. Given its critical severity and the network-exploitable nature of SSO systems, understanding its potential relevance to our environment is essential.

Unauthorized access without a password.
Critical, network-exploitable Single-Sign On flaw.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this flaw by sending specially crafted requests to the Single-Sign On (SSO) component of the affected system. Because no authentication or specific user interaction is needed to trigger the vulnerability, an attacker could potentially gain unauthorized access to any user account, including administrative privileges, without needing to know any credentials. This could allow them to take control of the system.

No authentication required to start.
Vulnerable SSO component triggers the flaw.
Full account takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the SSO component could allow an unauthenticated attacker to bypass authentication and access the system as any user, including administrators, without needing a password. When supported by the advisory, this could lead to unauthorized access to sensitive system data and user information.

System and user data may be exposed.
Attackers could bypass authentication.
Unauthorized access to system functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical authentication bypass in the SSO component likely impacts platform or infrastructure teams responsible for identity and access management. The immediate priority is to identify all instances of the affected SSO technology, determine their reachability and business criticality, and locate the accountable system owner to begin risk-based remediation planning.

Identify and confirm SSO ownership.
Verify exposure and critical assets.
Plan targeted remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Digital-Infrastructure?

Digital-Infrastructure is a software platform designed to manage and support core backend services. Version 9.6.7 specifically includes a Single-Sign On (SSO) module, which acts as a centralized authentication gateway. This component enables users to log into various integrated applications using a single set of credentials, streamlining identity management across an organization's network environment.

What does CWE-287 mean for CVE-2026-79576?

CWE-287 refers to Improper Authentication. In the context of CVE-2026-79576, it means the SSO component fails to correctly verify the identity of a user. Instead of requiring valid credentials, the system is susceptible to being tricked, allowing an attacker to impersonate anyone, including administrative accounts, without ever providing a password.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests directly to the SSO component. Because the vulnerability exists in the authentication logic itself, it does not require a legitimate user to click a link or perform any action. Simply reaching the SSO service with the malicious request is sufficient to bypass the security check.

Is my system at risk if it uses this SSO component?

According to Halo Surface Signal, because SSO systems are designed to be widely accessible to manage authentication across various platforms, they are often internet-facing or exposed across internal network segments. If your instance is reachable over a network, it is considered potentially accessible to unauthorized actors, making this a high-priority concern.

Do I need to take action if I use Digital-Infrastructure?

Yes. Start by creating an inventory of all systems running version 9.6.7 to confirm the presence of this SSO component. Once identified, evaluate which systems are business-critical and coordinate with the relevant technology owners. The goal is to verify your current exposure and prepare for remediation steps to secure these authentication services.

References

github.com/fangtang7/CVE/blob/main/Digital-Infrastructure/sso.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.