The vulnerability (CVE-2026-42604) in Actual Budget's sync-server affects versions <= 26.4.0. The POST /openid/config endpoint improperly authorizes access, exposing sensitive OpenID Connect configuration data such as the OAuth2 client_secret to unauthenticated callers who can supply the bootstrap password. Due to missing authentication and rate limiting, the bootstrap password can be brute-forced, increasing the risk of unauthorized access. This is classified under CWE-863 (Incorrect Authorization). The issue is fixed in version 26.5.0.

Exposure of the OAuth2 client_secret and OpenID Connect configuration can lead to unauthorized access to authentication mechanisms. The lack of authentication and rate limiting on the endpoint allows attackers to brute-force the bootstrap password, potentially compromising user data or the sync-server's security. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality and integrity.

Upgrade to Actual Budget sync-server version 26.5.0 or later, where this vulnerability is fixed. Until upgrading, restrict access to the POST /openid/config endpoint and implement external rate limiting and monitoring to reduce brute-force risk. Patch status is not explicitly confirmed in the vendor advisory, but version 26.5.0 is stated as the fix version.