TI-2022-16499 Aliases CVE-2022-36076 GHSA-xmgg-fx9p-prq6

Account takeover via SSO plugins in NodeBB

HIGH 73CWE-352Published 2022-09-02 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00576 47th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed NodeBB (NodeBB): 1.17.2nodebb (npm): 1.17.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeBB	NodeBB	before 1.17.2	1.17.2	Patch available	CNA
—	nodebb (npm)	before 1.17.2	1.17.2	Patch available	GHSA-xmgg-fx9p-prq6

NodeBB VendorNodeBB Affected before 1.17.2 Fixed in 1.17.2 Patch available CNA
nodebb (npm) Vendor— Affected before 1.17.2 Fixed in 1.17.2 Patch available GHSA-xmgg-fx9p-prq6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nodebb:nodebb::::::::	before 1.17.2	Vulnerable	NodeBB

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions before 1.17.2 Vulnerable ·NodeBB

Remediation

Fix · CNA NodeBB (NodeBB) Fixed in 1.17.2
Fix · GHSA-xmgg-fx9p-prq6 nodebb (npm) Fixed in 1.17.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36076
2026-10-03 Alias added: GHSA-xmgg-fx9p-prq6

References

Exploit 2

Patch 1

https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-36076

Other 2

TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
TI-2025-21119 Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote… CVSS 3.1MEDIUM 6.1

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences