rConfig Authentication Bypass Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- rconfig (npm)
- Affected versions
- >= core-8.2.9, <= core-8.2.9 or >= core-8.2.8, <= core-8.2.8 or >= core-8.2.7, <= core-8.2.7 or >= core-8.2.6, <= core-8.2.6 or >= core-8.2.5, <= core-8.2.5 or >= core-8.2.4, <= core-8.2.4 or >= core-8.2.3, <= core-8.2.3 or >= core-8.2.0, <= core-8.2.0 or >= core-8.1.3, <= core-8.1.3 or >= core-8.1.2, <= core-8.1.2 or >= core-8.1.1, <= core-8.1.1 or >= core-8.1.0, <= core-8.1.0 or >= core-8.0.2, <= core-8.0.2 or >= core-8.0.1, <= core-8.0.1 or >= core-8.0.0, <= core-8.0.0
- Patched version
- Not yet available
An authentication bypass vulnerability has been reported in rConfig versions 8.0.0 to 8.2.12 that allows unauthenticated attackers to self-register accounts with full Administrator privileges.
What happened
An early warning has been issued for a critical vulnerability in rConfig versions 8.0.0 to 8.2.12. This vulnerability, tracked as CVE-2026-77915, allows unauthenticated attackers to self-register accounts with full Administrator privileges. The issue arises from a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. As a result, attackers can register a new account that is immediately authenticated with Admin-level access, potentially compromising stored device credentials, user data, and API token issuance.
The vulnerability is due to the registration controller not assigning a role, and the users.role column defaults to Admin. This allows attackers to gain full administrative access without proper authentication. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
What to do about it
- Upgrade to rconfig@8.2.13 or later to mitigate the vulnerability.
- Review any potentially compromised accounts for unauthorized activity.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps.
How 0Day would have caught this
rconfig is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rConfig versions 8.0.0 to 8.2.12.
What should I do right now?
Upgrade to rconfig@8.2.13 or later and review any potentially compromised accounts.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Where can I find more information?
Consult the primary sources provided for more detailed information on CVE-2026-77915.