Description
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
- You use local auth strategy and your application remains without an initial user created
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Remote Code Execution through first-register and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment - CVE-2026-41900
- Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138
- Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
- Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability - CVE-2026-41265
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026