CVE-2026-25519 is an incorrect access control flaw in OpenSlides before 4.2.29, rated 8.1. Users synced from a SAML identity provider can be logged in through the local login form with their username and a trivial password shared across all of them. Upgrade to 4.2.29.
What's affected
- Product: OpenSlides, the web based assembly and presentation system.
- Affected: versions before 4.2.29, on instances that sync users from an external SAML identity provider.
- Fixed: 4.2.29.
- Not described as affected: instances with local users only.
How to check if you're exposed
Check whether your instance uses SAML at all, and which release you run. In the deployment directory:
docker compose images | grep -i openslides
If SAML is configured and the version is below 4.2.29, assume any synced account could be reached through the local login form. Review authentication logs for local logins by SAML users.
What to do now
- Upgrade to OpenSlides 4.2.29 or later.
- Review login history for local form logins by users who normally sign in through your identity provider.
- Reset sessions after upgrading so any existing access is cut off.
- Check what the admin and operator accounts could do during the exposure window, since elections and motions are the sensitive data here.
- Consider limiting access to the instance to the networks that need it.
Why it matters
The flaw is CWE-284, improper access control. The local login path did not exclude accounts that are supposed to authenticate only through the identity provider, so a shared trivial password worked for every one of them.
This is the kind of bug that single sign on projects trip over: two ways in, and only one of them is checked properly. An attacker needs a valid username, which for an assembly tool is often easy to guess or already public. The record does not mark exploitation in the wild.
Quick check
Does disabling SAML fix this?
The advisory fix is 4.2.29. Upgrading is the supported answer, and a configuration change alone is not described as one.
Sources
Last reviewed: 19 October 2026.
