Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters.
References
Configurations
History
30 Jun 2026, 15:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa - Patch | |
| References | () https://github.com/its-a-feature/Mythic/issues/564 - Issue Tracking | |
| References | () https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60 - Release Notes | |
| References | () https://www.vulncheck.com/advisories/mythic-unauthorized-c2-profile-configuration-access-via-unverified-payload-uuid - Third Party Advisory | |
| CPE | cpe:2.3:a:its-a-feature:mythic:*:*:*:*:*:*:*:* | |
| First Time |
Its-a-feature mythic
Its-a-feature |
29 Jun 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-29 18:16
Updated : 2026-06-30 15:56
NVD link : CVE-2026-57952
Mitre link : CVE-2026-57952
CVE.ORG link : CVE-2026-57952
JSON object : View
Products Affected
its-a-feature
- mythic
CWE
CWE-862
Missing Authorization