CVE-2026-110799

Summary

The password reset functionality in Vvveb CMS prior to version 1.0.8.7 allows unauthenticated attackers to bypass authentication by exploiting insufficient validation of the 'user' and 'token' GET parameters, enabling unauthorized account access.

Exploitability

Exploitation is straightforward for remote attackers with no authentication or user interaction required, as it relies on predictable parameter manipulation.

Blast radius

Successful exploitation grants full account takeover, leading to potential data theft, unauthorized content modification, and full system compromise.

Detection

Look for repeated or anomalous requests to the password reset endpoint (e.g., /reset-password) with missing, invalid, or reused token values in web server logs; however, no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Vvveb CMS version 1.0.8.7 or later, which contains the official patch for this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.