CVE-2026-36537 affects ThingsBoard v4.3.0.1 and involves an authentication bypass during the OAuth authorization code exchange process. The vulnerability arises because the application trusts user-supplied identity data within the user parameter at the /login/oauth2/code/ endpoint. By altering the email address in this JSON object, an attacker can bypass authentication controls and assume the identity of any user on the platform without valid credentials. This leads to full account compromise. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated remote attacker to bypass authentication and fully compromise any user account on the affected ThingsBoard instance. This results in complete loss of confidentiality, integrity, and availability of the targeted user accounts, potentially leading to unauthorized access to sensitive data and control over the platform functions associated with those accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint where possible and monitor for suspicious activity related to OAuth login attempts. Avoid deploying ThingsBoard v4.3.0.1 in untrusted environments or expose it to untrusted networks. Follow vendor communications for updates on patches or official mitigations.