CVE-2026-54184: Unauthenticated IDOR in Clean Login ≤1.15 – HIGH Severity

Technical summary

CVE-2026-54184 is an unauthenticated IDOR vulnerability (CWE-639) affecting Clean Login up to and including version 1.15. The vulnerability allows an attacker to craft requests that reference arbitrary internal objects without prior authentication, leading to unauthorized information disclosure or modification. The attack vector is network-based with low complexity; no user interaction is required. The CVSS 3.1 score of 8.2 (HIGH) reflects high impact on availability and integrity, though confidentiality is not directly compromised by the vector.

Business impact

Organizations deploying Clean Login 1.15 or earlier face significant operational risk. Attackers could modify user data, accounts, or system settings without authentication, leading to data corruption, unauthorized account changes, or service disruption. The availability impact (denial or degradation of service through manipulation) combined with integrity violations creates a material threat to business continuity and user trust. Customers may experience account lockouts, data loss, or unauthorized modifications to their profiles.

Affected systems

Clean Login plugin or application versions 1.15 and earlier are vulnerable. Any deployment running these versions is at risk, regardless of deployment environment or configuration. Versions 1.16 and later are assumed to have addressed this issue; verify with the vendor's release notes.

Exploitability

Exploitation is straightforward: no authentication credentials are needed, the attack does not require user interaction, and it operates over the network. An attacker can enumerate or guess object references (user IDs, resource identifiers) and directly request them to read or modify data. This makes the vulnerability relatively easy to exploit once discovered, though successful exploitation depends on understanding the application's object-naming scheme or parameter structure.

Remediation

Upgrade Clean Login to a patched version newer than 1.15. If upgrade is not immediately possible, implement network-level access controls to restrict direct object reference attempts, apply rate limiting to suspicious enumeration patterns, and monitor logs for anomalous direct object access. Input validation and access control enforcement at the application layer should be verified post-upgrade.

Patch guidance

Apply the latest version of Clean Login released after 1.15 as soon as possible. Verify against the vendor's official advisory or release notes to confirm the patched version number. Test the upgrade in a non-production environment first to ensure compatibility with your deployment. If you cannot patch immediately, document the timeline and implement compensating controls.

Detection guidance

Monitor application logs for repeated requests with varying object identifiers (e.g., sequential or randomized IDs in URLs or API parameters) from unauthenticated sessions. Watch for 200 OK responses to requests that should return 401 Unauthorized. Alert on access attempts to sensitive endpoints or resources by unauthenticated users. Implement Web Application Firewall (WAF) rules to detect and block common IDOR patterns, such as direct user ID enumeration in query strings or path parameters.

Why prioritize this

The combination of unauthenticated access, network reachability, high availability and integrity impact, and low exploitation complexity warrants immediate attention. CVSS 8.2 (HIGH) places this in the top tier for patching priority. Even though it is not currently on the CISA KEV catalog, the ease of exploitation and potential for widespread abuse across all users justifies treating it as critical for any organization using Clean Login 1.15 or earlier.

Risk score, explained

CVSS 3.1 score 8.2 reflects: network attack vector (AV:N), no special conditions required (AC:L), no authentication needed (PR:N), no user interaction required (UI:N), single security scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and high availability impact (A:H). The severity is HIGH because unauthenticated attackers can degrade or disrupt the service and modify data without authorization.

Frequently asked questions