CVE-2026-57952 describes an authorization bypass vulnerability in Mythic before version 3.4.0.60. Four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) fail to verify that the requesting operator owns the payload UUID they reference. This flaw allows an operator to invoke these endpoints using a payload UUID from a different operation, thereby accessing that operation's C2 profile configuration, which includes encryption keys and callback parameters. The vulnerability is rated medium severity with a CVSS 4.0 score of 6. No vendor advisory or patch information is currently available.

An attacker with operator-level privileges in Mythic can bypass authorization checks on specific REST endpoints to access sensitive configuration data from other operations. This includes encryption keys and callback parameters related to C2 profiles, potentially exposing critical operational secrets. The vulnerability does not require user interaction and has a high attack vector (network), but requires low privileges and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator privileges carefully and monitor access to the affected endpoints. Avoid sharing payload UUIDs across operations to limit exposure.