Skip to content
Authentication Bypass in Vvveb CMS Exposed to Attack

Authentication Bypass in Vvveb CMS Exposed to Attack

First seen 14 Nov 2026, 05:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 14, 2026 at 05:48 UTC
  • •CVE-2026-126377 allows unauthenticated cookie forgery in Vvveb CMS.
  • •Organizations with exposed Vvveb instances are at high risk of account takeover.
  • •Immediate patching to version 1.0.9.0 or later is crucial to mitigate this vulnerability.

A vulnerability, CVE-2026-126377, was disclosed for Vvveb versions before 1.0.9.0, allowing unauthenticated attackers to exploit an authentication bypass in the generateCookie() function. This vulnerability enables attackers to brute-force cookie values, potentially leading to account takeover with administrator-level access. Organizations using this PHP content-management system, particularly those with internet-facing instances, are at risk. The vulnerability was published on November 13, 2026, with a CVSS score of 9.2, indicating a severity level. However, there is currently no confirmation of active exploitation or proof-of-concept code available. Immediate patching is advised to mitigate risks, and organizations should monitor for unusual login activity. The vulnerability affects systems that rely on MD5 cookie hashes for authentication.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 10h ago How this analysis works

Timeline

2026-11-13
CVE-2026-126377 published
Vulnerability disclosed with a CVSS score of 9.2, indicating critical severity.
Redpacketsecurity
2026-11-14
Advisories issued
Security advisories released urging immediate patching for affected Vvveb versions.
www.vulncheck.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-126377 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

Which versions of Vvveb are affected?
All versions of Vvveb before 1.0.9.0 are affected by this vulnerability.
Is there any active exploitation of this vulnerability?
Currently, there is no confirmed active exploitation reported for CVE-2026-126377.
What should organizations do to protect themselves?
Organizations should upgrade to Vvveb version 1.0.9.0 or later and monitor for unusual login activity.