CVE-2026-79577

sso-master v1.0.0, a small open-source single sign-on (SSO) application, contains an improper access control flaw (CWE-284) in its /cas/login component. A remote, unauthenticated attacker can send a specially crafted POST request to /cas/login and obtain an authenticated session without ever supplying a valid password. Because the product is an SSO gateway, a successful login may also expose every downstream application or service that trusts it, which is why the flaw is rated critical at CVSS 9.8 with high impact on confidentiality, integrity, and availability. Only version 1.0.0 is identified as affected, and exposure is limited to self-hosted deployments of this project. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so exploitation in the wild is not currently known.

What to do: Monitor the project's repository for a patched release and move off version 1.0.0 as soon as a fix is published; no fixed version is named in the CVE data. In the interim, restrict access to /cas/login at the network or WAF layer (IP allowlisting, VPN-only access, blocking unexpected POST patterns) and avoid exposing the instance to the public internet. Review authentication and session logs for passwordless or anomalous logins and rotate credentials for accounts and downstream services integrated with the SSO.