CVE-2021-29487

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

• CWE-287

• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374Patch, Third Party Advisory
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5Patch, Third Party Advisory
• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374Patch, Third Party Advisory
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9Patch, Third Party Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5Patch, Third Party Advisory

Published

Aug 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29481Ratpack is a toolkit for creating web applications. In versi…7.5
• CVE-2021-29482xz is a compression and decompression library focusing on th…7.5
• CVE-2021-29483ManageWiki is an extension to the MediaWiki project. The 'wi…7.5
• CVE-2021-29484Ghost is a Node.js CMS. An unused endpoint added during the …6.8
• CVE-2021-29485Ratpack is a toolkit for creating web applications. In versi…8.8
• CVE-2021-29486cumulative-distribution-function is an open source npm libra…7.5
• CVE-2021-29488SABnzbd is an open source binary newsreader. A vulnerability…5.3
• CVE-2021-29489Highcharts JS is a JavaScript charting library based on SVG.…5.4
• CVE-2021-29490Jellyfin is a free software media system that provides media…5.8
• CVE-2021-29491Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-29492Envoy is a cloud-native edge/middle/service proxy. Envoy doe…8.3
• CVE-2021-29493Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE ex…8.8