CVE-2026-88897
Last modified
CVE-2026-88897 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| flextype | flextype | <= 1.0.0-alpha.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-88897?
How severe is CVE-2026-88897?
How do I fix CVE-2026-88897?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-88891OpenPanel through 2.3.0 fails to enforce read-only project a…8.3
- CVE-2026-88892In OpenPanel through 2.3.0, the data importer fetches a call…5
- CVE-2026-88893OpenPanel through 2.3.0 share lookup procedures fail to vali…7.5
- CVE-2026-88894Snipe-IT's predefined kit checkout path does not enforce Ful…5.4
- CVE-2026-88895CyberPanel before 3.0.5 fails to enforce two-factor authenti…7.2
- CVE-2026-88896EspoCRM before 10.0.4 is vulnerable to server-side request f…5.3
- CVE-2026-88898AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authori…6.5
- CVE-2026-88899knowns versions before 0.31.0 fail to properly validate the …9.8
- CVE-2026-8890code100x contains an authentication bypass vulnerability in …8.8
- CVE-2026-88900Deserialization of Untrusted Data vulnerability in Apache Ca…8.8
- CVE-2026-88901Improper Restriction of XML External Entity Reference vulner…8.2
- CVE-2026-88903The Topcontent WordPress plugin through 1.2.1 does not prope…8.8
Are you affected by CVE-2026-88897?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST