Authentication Bypass in rConfig Leads to Unauthorized Admin Account Creation

CVE-2026-77915

What is CVE-2026-77915?

The rConfig application versions prior to 8.2.13 exhibit an authentication bypass vulnerability that enables unauthorized users to create accounts with full Administrator privileges. This is caused by a flawed routing configuration in 'routes/web.php', where a previously disabled POST /register route is reactivated through a duplicated Auth::routes() call. Without proper role assignment in the registration controller, new accounts default to Admin status, granting immediate access to sensitive resources, including device credentials, user data, and API token generation.

References