CVE-2026-32969 PUBLISHED

Pre-Auth Blind SQLi in userinfo Endpoint

Assigner: CERTVDE
Reserved: 17.03.2026 Published: 23.03.2026 Updated: 23.03.2026

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Product Status

Vendor MB connect line
Product MB connect line mbCONNECT24
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor MB connect line
Product mymbCONNECT24
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor Helmholz
Product myREX24V2
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)
Vendor Helmholz
Product myREX24V2.virtual
Versions Default: unaffected
  • affected from 0.0.0 to 2.19.3 (incl.)

Credits

  • Moritz Abrell, Christian Zäske from SySS GmbH finder

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE