A broken access control flaw in Peppermint versions up to commit ba6e217 permits authenticated users to redirect authentication traffic, facilitating large-scale credential harvesting.

The application contains a broken access control vulnerability (CWE-284) where a configuration endpoint lacks administrative role verification. An authenticated, non-administrative user can modify global OIDC and SSO identity provider settings.

This vulnerability poses a critical risk to user authentication, as an attacker can redirect legitimate user logins to a malicious identity provider. This facilitates the theft of credentials for all platform users, potentially leading to unauthorized access to sensitive corporate data and widespread account takeover. The CVSS score of 8.8 reflects the high potential for total system impact.

Immediate Action: Monitor for vendor security updates and apply the patch that enforces administrative access checks on the OIDC configuration endpoint.

Proactive Monitoring: Review audit logs for any modifications to OIDC, SSO, or identity provider settings to identify unauthorized configuration changes.

Compensating Controls: Restrict access to the configuration management interfaces via network-level controls or internal VPN requirements until a permanent fix is applied.

Public Exploit Available: No

Due to the potential for complete authentication bypass and mass credential theft, this issue is of the highest priority. Security teams must ensure that administrative access to configuration endpoints is strictly controlled and updated to the latest secure version once released.