CVE-2026-45332 Automad Flat-File CMS Unauthenticated Admin Password Hash Disclosure via Broken Setup Endpoint — Offline Hash Cracking

1. Introduction

This document illustrates an unauthenticated sensitive data exposure vulnerability in Automad — a modern flat-file content management system. The vulnerability, tracked as CVE-2026-45332, allows any unauthenticated attacker to retrieve the bcrypt password hash of every administrator account in a single HTTP request — with no credentials, no session, and no prior knowledge of the target configuration. The exposed hash includes the embedded bcrypt salt and cost factor, making it immediately suitable for offline password cracking using tools such as Hashcat or John the Ripper.

The flaw resides in the CMS setup endpoint POST /_api/user-collection/create-first-user, which is intended only for the initial administrator account creation during first-time setup. In affected versions (2.0.0-alpha.1 through 2.0.0-beta.27), this endpoint remains publicly accessible even after setup is complete. When called, it loads the existing user collection from disk, appends the attacker-supplied user in memory, and returns the entire serialized user collection — including the passwordHash field of every pre-existing administrator — in the JSON response. Critically, the probe user is never written to disk, making this a pure read-only credential disclosure with zero impact on the running CMS state.

On the 2.0.0-beta.27 release (the first to include two-factor authentication support), the endpoint additionally discloses each administrator’s TOTP secret, allowing an attacker to bypass 2FA as well. The same response also discloses the server-side filesystem path of the credentials store (config/accounts.php), providing useful reconnaissance for further attack stages.

2. AUTOMAD Description

Automad is an open-source flat-file content management system developed by Marc Anton Dahmen. Unlike database-driven CMS platforms, Automad stores all site content, configuration, and user credentials as files on the server filesystem — making it lightweight and easy to deploy. It provides a browser-based dashboard for content editing, a template engine, and a REST API used by its own front-end. Automad is distributed via GitHub and Packagist and is deployed by individual developers, designers, and small organisations running self-hosted websites.

Because Automad stores administrator credentials in a PHP-serialized flat file (config/accounts.php) rather than a database, any endpoint that returns the contents of this file — even partially — directly exposes the credential material used to protect the entire CMS. There is no secondary credential validation layer, no token rotation, and no separation between the authentication store and the administrative interface: the bcrypt hash in accounts.php is the sole gate to administrator access.

3. Vulnerability Severity

4. Scope of Impact

This vulnerability affects all Automad installations running versions 2.0.0-alpha.1 through 2.0.0-beta.27 inclusive. The fix was introduced in 2.0.0-beta.28, which causes createFirstUser() to return 403 Another user has been created already as soon as config/accounts.php exists on disk — preventing any data from being loaded or returned.

 

 

The vulnerability exposes all user accounts in the Automad installation — not only the administrator. Any account stored in config/accounts.php has its passwordHash, email, and (on beta.27) totpSecret disclosed. On a typical single-administrator installation this means complete credential exposure; on multi-user installations it affects every account simultaneously. The endpoint also discloses the absolute server-side filesystem path of the accounts file — useful reconnaissance for path traversal or server-side file inclusion attacks in combination with other vulnerabilities.

5. Where is the vulnerability present?

The vulnerability is present in UserCollectionController::createFirstUser() — the handler for POST /_api/user-collection/create-first-user. This endpoint exists to create the very first administrator account when Automad is installed for the first time. In affected versions, it is never disabled or access-controlled after that initial setup. The critical sequence of operations in the vulnerable code is:

There is no call to isFirstUser(), no check for the existence of config/accounts.php, and no authentication requirement on the route. The generatePHP() method serializes the entire UserCollection object — including the passwordHash property of every existing user — as a PHP-serialized string embedded in the JSON response. The bcrypt hash format ($2y$10$…) carries the algorithm, cost factor, and 128-bit salt as a single 60-character string, fully self-contained for offline cracking.

The attack requires only two HTTP requests: a GET /dashboard/login to obtain a session cookie and CSRF token, followed by the POST /_api/user-collection/create-first-user with the CSRF token and any syntactically valid but entirely fake new-user body. The CSRF token is embedded in a <meta> tag in the public login page HTML — no authentication is needed to read it. The vulnerability is therefore exploitable by any unauthenticated party who can reach the Automad instance over the network.

On the patched version (2.0.0-beta.28), the handler begins with an existence check:

6. Risk

An unauthenticated attacker who can reach the Automad instance obtains the bcrypt password hash of every administrator in two HTTP requests. The bcrypt hash — with its embedded salt and cost factor — is immediately suitable for offline cracking against password lists, rule-based mutations, and GPU-accelerated brute force using standard tools such as Hashcat (mode -m 3200) or John the Ripper. For installations where administrators have chosen weak, common, or dictionary-based passwords, cracking may complete in seconds to minutes on commodity hardware. A cracked password grants full Automad administrator access — including content modification, theme file editing, and any file manager capabilities.

On installations running 2.0.0-beta.27 (the first release with TOTP two-factor authentication), the endpoint additionally discloses each administrator’s TOTP secret. Combined with the cracked password, this allows the attacker to bypass 2FA entirely — using any standards-compliant TOTP client to generate valid one-time codes for the compromised account. This upgrades the attack from password-dependent to a complete account takeover regardless of 2FA enrollment.

The response also discloses the absolute server-side filesystem path of the credentials store (e.g. /var/www/html/config/accounts.php). This path disclosure is directly useful for server-side file inclusion (LFI) attacks, path traversal probes, and understanding the deployment’s directory layout for subsequent exploitation. Even without cracking the hash, the email address of every administrator account is also disclosed — enabling targeted phishing, credential stuffing against other services, and social engineering.

The overall confidentiality impact is rated HIGH: all administrator authentication material, email addresses, server paths, and (on beta.27) 2FA secrets are exposed in a single unauthenticated request. The integrity and availability impacts are rated None for the disclosure itself — the probe user is never persisted, so the CMS state is not modified. However, a successful offline hash crack escalates the integrity and availability impact to full administrator access: all site content can be modified, deleted, or replaced, and the CMS can be taken offline.

7. Mitigation

The following actions should be taken immediately on any Automad installation running an affected version:

• Upgrade to Automad 2.0.0-beta.28 or later — the patched release makes createFirstUser() return 403 Another user has been created already before loading any user data, eliminating the disclosure entirely.
• Block the endpoint at the reverse proxy or WAF (if immediate upgrade is not possible): deny all requests to /_api/user-collection/ for unauthenticated clients. No legitimate site visitor requires access to this path after initial setup.
• Rotate all administrator passwords immediately — assume any bcrypt hash exposed before patching has been captured. Generate new strong passwords and update them in the Automad dashboard.
• Re-enroll TOTP secrets for any administrator accounts on 2.0.0-beta.27 — the TOTP secret disclosed in the response can be used to generate valid codes indefinitely until re-enrollment. Revoke existing TOTP configuration and issue new secrets.
• Audit administrator email addresses for unexpected phishing or account-stuffing activity — the disclosed emails may be targeted separately from the Automad instance itself.
• Review access logs for requests to /_api/user-collection/create-first-user — the two-request exploitation pattern (GET /dashboard/login followed by POST to the API endpoint) is detectable in web server access logs.

8. Exploit Implementation

Attack Scenario

The exploit is demonstrated against a self-hosted Automad 2.0.0-beta.27 instance running in a Docker container on a Linux host. A patched twin running 2.0.0-beta.28 on port 8293 returns HTTP 403 with Another user has been created already for the same request.

Prerequisites:

• Docker (containers already running — vuln at http://127.0.0.1:8292, patched at http://127.0.0.1:8293)
• Python 3 with the requests library (auto-installed by exploit.py)
• Nuclei for automated vulnerability confirmation
• curl for manual two-step disclosure demonstration
• A terminal (tested on Kali Linux / Ubuntu 22.04)

Exploitation

  📸 Screenshot: Terminal showing curl HTTP 200 response and the CSRF meta tag grep output confirming the Automad login page is accessible.

  📸 Screenshot: Terminal showing Nuclei output — [CVE-2026-45332] [http] [high] matched on port 8292, no output on port 8293.

  📸 Screenshot: Terminal showing the CSRF extraction command and the token value printed — confirms unauthenticated access to the token.

  📸 Screenshot: Terminal showing the POST curl command and the JSON response with the serialized PHP data visible — admin bcrypt hash and configDir path clearly readable in the output.

  📸 Screenshot: Terminal showing full exploit.py output with [!!!] EXPLOITED, admin username, email, bcrypt hash, and secrets file path all clearly visible.

  📸 Screenshot: Terminal showing docker exec cat output with the bcrypt hash from the actual accounts.php file — matching the hash extracted by exploit.py.

  ⚠  EXPLOITATION SUMMARY

 Two unauthenticated HTTP requests — GET /dashboard/login then POST /_api/user-collection/create-first-user.

  No credentials, no session, no prior knowledge of the target required.

  CSRF token is publicly readable from the unauthenticated login page HTML.

  Admin bcrypt hash disclosed in JSON response — immediately usable for offline cracking.

  Probe user is never written to disk — pure read-only disclosure, zero CMS state change.

  On 2.0.0-beta.27: TOTP secret also disclosed — bypasses 2FA even with a known hash.

  Server-side config path disclosed — enables targeted path traversal reconnaissance.