CVE-2022-39360 Metabase SSO users able to circumvent IdP login by doing password reset
SSO users can bypass identity provider authentication by triggering password resets, allowing unauthorized access to Metabase accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39360?
CVE-2022-39360 is a medium-severity authentication bypass vulnerability in metabase, published on 26 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase now blocks password reset for all users who use SSO for their Metabase login.
Which versions are affected by CVE-2022-39360?
It affects 1 product.
Products include Metabase Metabase.
How do I fix CVE-2022-39360?
No fix has been published for CVE-2022-39360 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-39360 being exploited?
There is no known exploitation of CVE-2022-39360 in the wild and no public exploit code.
Other vulnerabilities in metabase
- CVE-2026-72898 Metabase SQL Injection
- CVE-2021-41277 Metabase GeoJSON API Local File Inclusion
- CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2023-37470 Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
- CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
Sources
Also known as GHSA-gw4g-ww2m-v7vc.