Skip to content
Verified reproduction

CVE-2026-27960: OpenCTI authentication bypass via user impersonation

CVE-2026-27960 is verified against opencti · docker affected versions: >= 6.6.0, < 6.9.13 (i.e. 6.6.0 through 6.9.12) fixed version: 6.9.13 vulnerability class: Auth Bypass This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00314.

REPRO-2026-00314 opencti · docker Auth Bypass Jul 30, 2026 CVE entry .txt
Severity CRITICAL
Confidence HIGH
Reproduced in 44m 34s
Tool calls 173
Spend $3.15
Affected >= 6.6.0, < 6.9.13 (i.e. 6.6.0 through 6.9.12)
Fixed in 6.9.13
$ pruva-verify REPRO-2026-00314
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00314/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Deep-researched manual dossier: OpenCTI versions 6.6.0 through 6.9.12 are affected by an authentication bypass that allows an unauthenticated attacker to query the API as any existing user, including the default admin account. The issue impacts the GraphQL API and results in unauthorized access to threat intelligence data and administrative actions. Fixed in OpenCTI 6.9.13. Canonical repository: https://github.com/OpenCTI-Platform/opencti.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.