Read the docs
TI-2026-62471 Aliases CVE-2026-92626GHSA-8hjh-385q-g4vq

Control iD iDSecure Unauthenticated Denial of Service

Priority LOW 39CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed iDSecure (Control iD): 4.8.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Control iDiDSecurebefore 4.8.3.04.8.3.0Patch availableCNA
  • iDSecure VendorControl iD Affected before 4.8.3.0 Fixed in 4.8.3.0 Patch available CNA

Remediation

  • Fix · CNA iDSecure (Control iD) Fixed in 4.8.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Control iD iDSecure 4.8.3.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-62470 Control iD iDSecure Unauthenticated Denial of ServicePriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92626
  2. 2026-10-03 Alias added: GHSA-8hjh-385q-g4vq

References

Other 1

  • TI-2023-05811 Control iD iDSecure passwordCustom Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-02275 Control iD RHiD department cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-04057 Control iD Gerencia Web Cookie cleartext storage CVSS 3.1MEDIUM 5.3
  • TI-2025-31768 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises CVSS 4.0CRITICAL 9.3
  • TI-2025-31767 Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises CVSS 4.0HIGH 8.7
  • TI-2025-31766 Improper Authentication in ControlID iDSecure On-premises CVSS 4.0HIGH 8.7
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences