{"id":"CVE-2026-77172","kind":"vulnerability","aliases":["CVE-2026-77172"],"related":[],"title":"App passwords could skip password confirmation on sensitive account endpoints","description":"App passwords were allowed to bypass password confirmation on sensitive endpoints.","summary":"App passwords were accepted in place of the account password on some sensitive endpoints that normally require password confirmation. An attacker holding an app password could perform those sensitive actions without the main password.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:53+00:00","updated_at":"2026-10-27T17:34:53+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T17:34:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"App passwords could skip password confirmation on sensitive account endpoints","impact":"medium","summary":"App passwords were accepted in place of the account password on some sensitive endpoints that normally require password confirmation. An attacker holding an app password could perform those sensitive actions without the main password.","category":"other","nicknames":[],"who_cares":["self-hosted"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker with an app password performs sensitive account actions unchecked","analyst_note":"Sources give only the one-line description and CVSS 5.3; find the affected product and fixed version at the NVD entry or the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000485,"input_tokens":3233,"output_tokens":323,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77172':13A,16A 'accept':24B 'account':9A,29B 'action':50B 'allow':58C 'app':1A,21B,44B,55C 'attack':41B 'bypass':60C 'confirm':6A,39B,62C 'could':3A,46B 'cve':11A,14A 'endpoint':10A,34B,65C 'hold':42B 'host':20B 'main':53B 'normal':36B 'password':2A,5A,22B,30B,38B,45B,54B,56C,61C 'perform':47B 'place':26B 'requir':37B 'self':19B 'self-host':18B 'sensit':8A,33B,49B,64C 'skip':4A 'without':51B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77172","severity":null,"published_at":"2026-10-27T17:17:02+00:00","modified_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}