CVE-2026-19974

A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

• CWE-287

• https://github.com/theopaid/Authentication-Bypass-via-HMAC-Session-Cookie-Forgery-treefrog-framework-
• https://github.com/treefrogframework/treefrog-framework/
• https://github.com/treefrogframework/treefrog-framework/issues/436
• https://vuldb.com/cve/CVE-2026-19974
• https://vuldb.com/submit/873625
• https://vuldb.com/vuln/391153
• https://vuldb.com/vuln/391153/cti

Published

Aug 17, 2026

Last Modified

Aug 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19969A security vulnerability has been detected in Open Asset Imp…5.4
• CVE-2026-1997Certain HP OfficeJet Pro printers may expose information if …5.3
• CVE-2026-19970A vulnerability was detected in Open Asset Import Library As…6.3
• CVE-2026-19971A flaw has been found in LB-Link WR1210M 1.0.3. This impacts…4.7
• CVE-2026-19972A vulnerability has been found in itsourcecode Hospital Mana…6.3
• CVE-2026-19973A vulnerability was found in itsourcecode Hospital Managemen…6.3
• CVE-2026-19975A weakness has been identified in Azuriom CMS up to 1.2.12. …3.1
• CVE-2026-19976A security vulnerability has been detected in COMFAST CF-N1-…6.6
• CVE-2026-19977A vulnerability was detected in EFM ipTIME A3004T 14.19.0. T…10
• CVE-2026-19978A flaw has been found in jiantao88 android-mcp-server up to …5.3
• CVE-2026-19979A vulnerability was identified in GL.iNet A1300, AX1800, AXT…8.3
• CVE-2026-1998A flaw has been found in micropython up to 1.27.0. This vuln…5.5