2026-10-20
Request to Take Measures Against Unauthorized Admin Panel Logins
Large numbers of ID and password combinations leaked through past data breaches are currently in circulation. In light of this situation, we strongly recommend that all sites using Kuroco implement one of the following measures.
- Measure A: IP address restriction for the admin panel, and an audit of IDs and passwords
- Measure B: Stop using email address and password login, and allow SSO (external login) only
Both can be configured with Kuroco's standard features.
Assumed risk
If no IP address restriction is set for the admin panel, a third party can attempt to log in using leaked credentials. If the leaked credentials match the ones currently in use, unauthorized access succeeds through the regular login procedure, without exploiting any system vulnerability.
Kuroco has a feature that temporarily locks the login process after multiple failed login attempts, which mitigates the risk of brute-force attempts. However, if a correct ID and password combination has been leaked, the login may succeed within a small number of attempts, and the lock feature alone cannot prevent it.
Measure A: IP address restriction for the admin panel, and an audit of IDs and passwords
1. Set an IP address restriction for the admin panel
Click [Environment] -> [Admin panel] -> [Admin panel], select "Enable" for [Admin panel access restriction (IP address)], and enter the IP addresses to allow. You can specify a single address or use CIDR notation.
If you use Admin MCP, also set [Admin MCP access restriction (IP address)].
Once the setting is saved, the admin panel can no longer be accessed from IP addresses other than the registered ones. Before saving, make sure that all connection sources from which the admin panel is used are registered, including the IP address of the network you are currently working from and those used for remote work or while away from the office.
For details, see Admin panel.
2. Audit IDs and passwords
Check the following and clean up unnecessary accounts and excessive permissions.
- Delete unnecessary accounts: In [Member] -> [Member], check whether accounts of people who have left or changed roles, external partners whose contracts have ended, or test accounts remain.
- Review users and permissions: Check that the groups and permissions of each member are not excessive for their current duties.
- Review password management: Check that passwords are not reused from other services and that shared accounts are not used by multiple people. Change passwords as needed.
- Check login records: In [Operation] -> [Log management], check [Login log] and [Failed logins] for any unfamiliar logins or failures.
If you manage members with an identity provider such as Microsoft Entra ID, SCIM integration is also effective. Creating, updating, and deleting members is automatically synchronized from the identity provider to Kuroco, and unassigning a user on the identity provider side also deactivates the corresponding Kuroco member, which prevents accounts of people who have left or changed roles from being left behind. Note that group permissions are not synchronized, so configure them in the Kuroco admin panel.
We also recommend reviewing the following settings in [Environment] -> [Site settings].
| Item | Description |
|---|---|
| Authentication code | Select whether to use a one-time password when logging in to the admin panel (Don't use, use, required). If set to required, users cannot log in without a one-time password even if the ID and password match. |
| Login lock | After five failed login attempts, the account will be locked. |
| Password blacklist | Set passwords that are not allowed, such as passwords identical to the login ID or email address. |
For details, see Site settings.
Measure B: Allow SSO (external login) only
If your organization uses an identity provider such as an IDaaS, Google Workspace, or Microsoft Entra ID, restricting admin panel login to SSO prevents a leaked Kuroco email address and password from being used to log in to the admin panel.
- Configure SSO login to the admin panel using SAML SP, OAuth SP, or IDaaS SP.
- Confirm that you can log in via SSO.
- Click [Environment] -> [Admin panel] -> [Admin panel] and select "Enable" for [Disable e-mail login for admin panel].
If you perform step 3 first and the SSO configuration has a problem, you will be unable to log in to the admin panel. Always confirm that you can log in via SSO before changing this setting.
For SSO configuration, see the following.
For member sites: Introduce two-factor authentication
Member sites that implement member login on the frontend face the same risk of unauthorized login with leaked IDs and passwords. Because IP address restrictions often cannot be applied to member sites, we recommend introducing two-factor authentication to the login API.
You can enable two-factor authentication by selecting a method in [twofactor_method] of the login endpoint (login_challenge). The possible values are code (TOTP), email (email), and SMS (SMS). When two-factor authentication is enabled, you need to implement a one-time password input screen and a call to login_challenge_mfa on the frontend.
In addition, checking [use_recaptcha] to use reCAPTCHA during login helps suppress automated login attempts.
For implementation details, see the following.
- Implementing Two-Factor Authentication on the Login Screen
- Endpoint Basic Settings/Advanced Settings List
Timeline
We strongly recommend implementing these measures as early as possible.
Our ongoing commitment
Kuroco will continue to prioritize security and strengthen its features accordingly. To help keep your site secure, we also ask for your cooperation in implementing the measures above.
Contact
If you have any further questions regarding this matter, please feel free to contact Kuroco Support.
Related documents
Support
If you have any other questions, please contact us or check out Our Slack Community.