Concrete CMS OAuth 2.0 Authorization-Code Handler Account Status Bypass Vulnerability

A vulnerability exists in Concrete CMS versions 9.5.0 and earlier, where the OAuth 2.0 Authorization-Code Handler bypasses account status checks. Users with a status of 'inactive' (suspended, banned, or terminated) can still authenticate via OAuth and receive valid API tokens. This flaw could potentially be exploited to access restricted resources or perform actions on behalf of the user.

Impact

Exploitation of this vulnerability allows inactive users to authenticate via OAuth, bypassing account status restrictions and potentially leading to unauthorized access or actions within the application.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.