CVE-2026-49952: Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

Synopsis

Authentication bypass in Discuz! X5.0 (releases 20260320 through 20260501) allows an unauthenticated remote attacker to forge a valid signed token by abusing a shared cryptographic key exposed through the login endpoint's encryption oracle in dbbak.php. The attacker sends a crafted username payload over the network, no credentials required, to obtain a token that unlocks the database backup and restore API. Successful exploitation gives the attacker full read and write access to the database, with a secondary ability to impersonate arbitrary users via a race condition. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Discuz! login and dbbak.php endpoints over the network; there is no local-only or physical requirement.

• AuthenticationNot required

  No account or credentials of any kind are needed; the attack begins from a fully unauthenticated state by submitting a crafted username to the login endpoint.

• Victim interactionNot required

  The attacker operates entirely autonomously against the service; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free for the primary token-forgery path; a secondary race condition exists for user impersonation but does not affect the core database access primitive.

Blast Radius

• Reads the full database export, including stored credentials, session tokens, private messages, and all user records.
• Writes arbitrary data back into the database via the restore endpoint, allowing modification or deletion of any persisted content.
• Impersonates arbitrary registered users by winning the documented race condition, enabling account takeover without knowing any password.
• Grants persistent administrative access if the attacker overwrites administrator credentials or session data during the import operation.