CVE-2026-27960: OpenCTI authentication bypass via user impersonation
CVE-2026-27960 is verified against opencti · docker affected versions: >= 6.6.0, < 6.9.13 (i.e. 6.6.0 through 6.9.12) fixed version: 6.9.13 vulnerability class: Auth Bypass This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00314.
pruva-verify REPRO-2026-00314 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00314/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Deep-researched manual dossier: OpenCTI versions 6.6.0 through 6.9.12 are affected by an authentication bypass that allows an unauthenticated attacker to query the API as any existing user, including the default admin account. The issue impacts the GraphQL API and results in unauthorized access to threat intelligence data and administrative actions. Fixed in OpenCTI 6.9.13. Canonical repository: https://github.com/OpenCTI-Platform/opencti.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.