Security Vulnerability Disclosures — CVE-2026-78829 / 78830 / 78831 / 78832

Public technical disclosures and proof-of-concept reproduction steps for four vulnerabilities assigned CVE IDs by the MITRE CVE Program (CVE request logged 2026-06-20).

Disclosed Vulnerabilities

CVE ID	Product	Vulnerability	CWE	CVSS 3.1	Auth required
CVE-2026-78829	Dromara MaxKey 4.x	Reflected XSS via redirect_uri in OAuth flow → admin session/JWT theft	CWE-79	8.2 High	No (crafted link)
CVE-2026-78830	mingSoft MCMS 6.1.1	Stored XSS via unauthenticated /file/upload	CWE-79	6.1 Medium	No
CVE-2026-78831	OpenAuth.Net ≤ 8.3.4	Unauthenticated arbitrary user password change via /api/dynamic/Invoke	CWE-306	9.1 Critical	No
CVE-2026-78832	OpenAuth.Net ≤ 8.3.4	Unauthenticated sensitive information disclosure via /api/dynamic/GetList	CWE-200	8.6 High	No

Each folder contains:

• README.md — full advisory: official CVE description, root-cause analysis, step-by-step reproduction (HTTP request/response pairs and curl one-liners), impact, remediation, references, and timeline.
• CVE-2026-XXXXX.json — the vulnerability record in CVE JSON 5 format, matching the structure used by the official cvelistV5 repository, prepared by the reporter for reference.

Attack chain note (OpenAuth.Net)

CVE-2026-78831 and CVE-2026-78832 share the same root cause — the Dynamic API (/api/dynamic/*) performs no authentication/authorization — and can be combined into a complete unauthenticated takeover chain:

1. GetList (CVE-2026-78832) dumps SysUser → all plaintext credentials;
2. Invoke (CVE-2026-78831) changes the administrator password (or simply log in with the dumped password);
3. The unrestricted, unauthenticated /api/Files/Upload endpoint (separately reported, no CVE ID assigned yet) enables arbitrary file upload with WebShell/RCE potential.

Additional findings (no CVE ID assigned)

During the same research, two further unauthenticated issues were identified in OpenAuth.Net but did not receive CVE IDs in the current assignment:

• Unauthenticated data deletion via /api/dynamic/Delete (CWE-285, incl. audit-log deletion for anti-forensics) — Medium;
• Unauthenticated unrestricted file upload via /api/Files/Upload (CWE-434, RCE potential) — Critical.

These are documented in the local research report and may be submitted to the CVE Program separately.

Responsible Disclosure

All reproduction was performed in controlled lab environments against privately-owned test instances or authorized targets. Sensitive values in captured responses (passwords, tokens, secrets) are redacted in these write-ups. These disclosures are published solely for defensive purposes — to help users of the affected products assess and mitigate the risk.

Timeline

Date	Event
2026-06-20	CVE request logged with the MITRE CVE Program
2026-06-24	OpenAuth.Net lab verification completed
2026-06	CVE-2026-78829 ~ CVE-2026-78832 assigned by MITRE
2026-10-30	Public technical disclosure on GitHub

---

Discovered and reported by CloudFutureSec (@CloudFutureSec).