CVE-2026-72561

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions prior to commit ba6e217

Description Broken access control allows authenticated non-administrative users to reconfigure global OIDC/SSO settings. This occurs because a configuration endpoint fails to perform administrative role checks before applying new OIDC issuer settings. An attacker can exploit this to redirect all Single Sign-On (SSO) logins to a malicious identity provider to harvest credentials from all platform users.

Recommendations Update Peppermint Lab Peppermint to a version including commit ba6e217 or later.