CVE-2026-1202
Last modified
CVE-2026-1202 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. EPSS estimates a 0.79% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Crmeb | Crmeb | <= 5.6.3 |
References
- https://github.com/foeCat/CVE/blob/main/CRMEB/apple_login_auth_bypass.mdExploit, Mitigation, Third Party Advisory
- https://vuldb.com/?ctiid.341788Permissions Required, VDB Entry
- https://vuldb.com/?id.341788Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.734711Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-1202?
How severe is CVE-2026-1202?
How do I fix CVE-2026-1202?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12014Use after free in Cast in Google Chrome prior to 149.0.7827.…8.3
- CVE-2026-12015Use after free in Autofill in Google Chrome prior to 149.0.7…5.3
- CVE-2026-12016Inappropriate implementation in DevTools in Google Chrome pr…8.3
- CVE-2026-12017Inappropriate implementation in Extensions in Google Chrome …3.1
- CVE-2026-12018Inappropriate implementation in Mojo in Google Chrome on Win…8.8
- CVE-2026-12019Heap buffer overflow in Codecs in Google Chrome on Linux and…8.3
- CVE-2026-12020Use after free in Autofill in Google Chrome on Mac prior to …8.8
- CVE-2026-12022Race in Safe Browsing in Google Chrome on Mac prior to 149.0…8.3
- CVE-2026-12023Use after free in GPU in Google Chrome on Mac prior to 149.0…8.3
- CVE-2026-12024Insufficient policy enforcement in DevTools in Google Chrome…6.5
- CVE-2026-12025Insufficient validation of untrusted input in Network in Goo…5.3
- CVE-2026-12026Out of bounds read in Video in Google Chrome on ChromeOS pri…6.5
Are you affected by CVE-2026-1202?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST