CVE-2026-55181

Name of the Vulnerable Software and Affected Versions Tugtainer versions prior to 1.30.3

Description OIDC authentication can be initiated even when the OIDC ENABLED variable is set to false. While the '/auth/oidc/enabled' endpoint correctly reports that the feature is disabled, a direct request to the '/auth/oidc/login' endpoint still triggers the OIDC login flow. This process returns an HTTP 302 response, sets an oidc state cookie, and redirects the user to the configured OIDC authorization endpoint, effectively bypassing the intended disable switch.

Recommendations Update to version 1.30.3.