CVE-2026-45274 PoxenStudio CVE debrief

Who should care

Defenders responsible for MyBooks instances, especially those using versions 3.41.2 or earlier, should assess exposure to this vulnerability and prioritize verification and remediation efforts.

Why it matters

CVE-2026-45274 is a vulnerability in MyBooks that allows unauthorized account creation and authentication bypass, which can be used to gain access to user-level API functionality. Defenders should prioritize verifying exposure, especially if using MyBooks versions 3.41.2 or earlier, and ensure the fix in version 3.42.0 has been applied.

• An attacker can create a valid account without authorization, bypassing intended account-creation policies.
• The newly created account can authenticate immediately and access user-level API functionality, even if it has not been activated.
• This vulnerability can provide a low-privilege account required by related authorization vulnerabilities.
• Defenders need to verify exposure, especially if using MyBooks versions 3.41.2 or earlier, and ensure the fix in version 3.42.0 has been applied.

Technical summary

The SignUp.post handler in webserver/handlers/user.py does not enforce the ALLOW_REGISTER configuration flag, allowing an unauthenticated remote attacker to create a valid account on an instance where public registration has been disabled. The process_auth_header function in webserver/handlers/base.py does not verify the account's active flag, allowing the newly created and unactivated account to authenticate immediately and access user-level API functionality.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially if they are using MyBooks versions 3.41.2 or earlier, and assess whether public registration has been disabled. They should also verify that the fix in version 3.42.0 has been applied.

Recommended defensive actions

• Verify the MyBooks version and ensure it is 3.42.0 or later.
• Check if public registration has been disabled and if the ALLOW_REGISTER configuration flag is enforced.
• Monitor for any unauthorized account creations or authentication attempts.
• Consider implementing additional security measures to prevent similar vulnerabilities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. Additional information is provided by source references from GitHub, including a commit fixing the issue and a security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.