PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-104108 error311 CVE debrief

CVE-2026-104108 debrief based on CVE Program and NVD records. FileRise OIDC login vulnerability allows an attacker to bind their identity to an existing local account. The issue is fixed in version 3.23.0. This vulnerability allows an attacker to potentially gain unauthorized access to FileRise instances using OIDC login. Defenders should assess exposure and apply the fix to prevent potential security breaches. The vulnerability is particularly concerning for instances using OIDC login, as it could allow attackers to exploit existing local accounts.

Vendor
error311
Product
FileRise
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders managing FileRise instances, especially those using OIDC login, should assess exposure and apply the fix. This includes reviewing identity provider configurations and verifying exposure of FileRise instances to OIDC login. Additionally, defenders should prioritize application of version 3.23.0 or later to prevent potential security breaches. Security teams and vulnerability management teams should also be aware of this vulnerability and its and

Why it matters

CVE-2026-104108 allows an attacker to bind their OIDC identity to an existing FileRise local account. Defenders should verify exposure, especially for instances using OIDC login, and apply the fix in version 3.23.0 or later.

  • Verify exposure of FileRise instances to OIDC login
  • Assess potential for attacker identity binding
  • Prioritize application of version 3.23.0 or later

Technical summary

FileRise OIDC login maps authenticated OIDC identity to local account using mutable preferred_username or email claims. An attacker with provider-issued claims colliding with an existing local username can be logged in as that account. This vulnerability is particularly concerning for instances using OIDC login, as it could allow attackers to exploit existing local accounts. The issue is fixed in version 3.23.0, which addresses the vulnerability by properly handling OIDC identity mapping. Defenders should review the official CVE record and NVD detail page for more information.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, especially for FileRise instances using OIDC login.

Recommended defensive actions

  • Verify FileRise instance exposure to OIDC login
  • Apply version 3.23.0 or later
  • Review identity provider configurations
  • Assess potential for attacker identity binding
  • Prioritize application of version 3.23.0 or later
  • Verify exposure of FileRise instances to OIDC login and assess potential impact
  • Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. However, additional details on exploitability and potential impact are limited. Further verification is needed to determine the full scope of the vulnerability and its potential impact on FileRise instances. Defenders should review the official CVE record and NVD detail page for more information and verify exposure of FileRise instances to OIDC login.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-104108 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-104108

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-104108 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-104108

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • FileRise OIDC login can bind an attacker identity to an existing local account

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/104xxx/CVE-2026-104108.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/error311/FileRise/releases/tag/v3.23.0

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.