CVE-2026-126377 · Package
NO FIX YET · SEE WHAT TO DO
Vvveb is a PHP content management system whose login cookie check uses a loose comparison on MD5 hashes. An unauthenticated attacker can brute-force a cookie value that hashes to a magic 0e string and forge a persistent cookie to take over any account.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Vvveb before 1.0.9.0 with a publicly reachable login are exposed, since the flaw is reached without credentials. Installations on a private network or behind access control are less exposed. unknown whether other products share the code.
Not affected if version-1.0.9.0-or-later
Who cares cms, php, self-hosted, vvveb
1.0.9.0 are listed as affected.system/user/user.php for the generateCookie() function and whether it compares hashes with ==.1.0.9.0 or later.Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.