---
id: "CVE-2026-77172"
kind: "vulnerability"
aliases: ["CVE-2026-77172"]
title: "App passwords could skip password confirmation on sensitive account endpoints"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted"]
not_affected_if: []
published_at: "2026-10-27T17:17:02+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:34:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77172", "first_seen_at": "2026-10-27T17:32:46+00:00"}]
---

# App passwords could skip password confirmation on sensitive account endpoints

App passwords were accepted in place of the account password on some sensitive endpoints that normally require password confirmation. An attacker holding an app password could perform those sensitive actions without the main password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77172

## From the sources

App passwords were allowed to bypass password confirmation on sensitive endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_