CVE-2026-36537: ThingsBoard v4

Synopsis

An authentication bypass vulnerability affects ThingsBoard v4.3.0.1, specifically in the OAuth authorization code exchange flow. A remote attacker with no credentials can manipulate the email address in the user-supplied JSON object sent to the /login/oauth2/code/ endpoint to impersonate any existing account. Successful exploitation gives the attacker complete control over the targeted account, including full read, write, and administrative access to whatever that account can reach. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the ThingsBoard service via HTTP/S from a remote location.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker supplies a crafted unauthenticated request to the OAuth callback endpoint.

• Victim interactionNot required

  The attack is fully self-contained and does not require any action from a legitimate user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to craft a JSON payload with a target email address, with no race conditions or environmental dependencies involved.

Blast Radius

• Attacker gains full authenticated session as any chosen account, including administrator accounts, without knowing the account password.
• Reads all data accessible to the compromised account, including device telemetry, dashboards, API keys, and stored credentials for integrated systems.
• Modifies or deletes device configurations, rules, dashboards, and tenant settings within the scope of the hijacked account.
• Disrupts platform operations by altering or removing critical automation rules and device pipelines under the compromised account.