CyberRota Analysis
AI-GeneratedTugtainer versions prior to 1.31.3 are vulnerable due to improper handling of OIDC tokens, which allows for the extraction of user claims without signature verification or validation checks. This could lead to unauthorized access and session hijacking, posing a significant security risk for users relying on Docker container automation. Organizations using Tugtainer should prioritize upgrading to version 1.31.3 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3.