rConfig Authentication Bypass via Duplicate Auth Route Registration

Technical Analysis

CVE-2026-77915 stems from a duplicate bare Auth::routes() call in routes/web.php that inadvertently re-enables the POST /register endpoint after developers explicitly disabled public registration. Because the registration controller fails to assign a role during account creation, and the users.role database column defaults to Admin, any newly self-registered account is immediately provisioned with full administrative rights. This allows unauthenticated attackers to bypass authentication entirely, gain admin console access, retrieve stored device credentials (SSH/SNMP/Telnet secrets for managed routers/switches), and mint new API tokens for further automation abuse. Organizations that use rConfig as part of network automation pipelines feeding configuration data into AI agents or RAG-based network operations assistants face a credential and topology exposure risk: stolen device credentials and API tokens could be leveraged to poison configuration data ingested by agents or to pivot into agent-controlled infrastructure management workflows.

Affected Systems

rConfig versions 8.0.0 up to (but not including) 8.2.13; self-hosted rConfig instances with default Laravel routing configuration and the registration route enabled via routes/web.php

Indicators of Compromise

• N/A - authentication logic flaw, no known file hashes or network IOCs published; monitor for anomalous POST requests to /register endpoint and unexpected new Admin-role user accounts

Remediation Steps

1. 1

   Upgrade rConfig

   Update to rConfig version 8.2.13 or later where the duplicate Auth::routes() call and default role assignment issue are fixed.

2. 2

   Audit user accounts

   Review all user accounts in the rConfig database for unexpected or unauthorized Administrator-role accounts, particularly any created outside of known onboarding processes.

3. 3

   Restrict network access

   Limit access to the rConfig web interface to trusted internal networks or VPN, and disable public internet exposure of the /register endpoint.

4. 4

   Rotate credentials

   Rotate all device credentials (SSH, SNMP, Telnet) and API tokens stored within rConfig following any suspected compromise.

5. 5

   Enable monitoring

   Implement logging and alerting on new account registrations and role changes within the rConfig application.