{"id":"CVE-2026-126377","kind":"vulnerability","aliases":["CVE-2026-126377"],"related":[],"title":"Vvveb: loose comparison in login cookie lets attackers take over accounts","description":"Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.","summary":"Vvveb is a PHP content management system whose login cookie check uses a loose comparison on MD5 hashes. An unauthenticated attacker can brute-force a cookie value that hashes to a magic 0e string and forge a persistent cookie to take over any account.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","self-hosted","vvveb"],"not_affected_if":["version-1.0.9.0-or-later"],"how_to_check":"- Check the Vvveb version in use: versions below `1.0.9.0` are listed as affected.\n- Look at `system/user/user.php` for the `generateCookie()` function and whether it compares hashes with `==`.","fix":"- Vvveb: move to `1.0.9.0` or later.","status":"open","published_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:48:35+00:00","updated_at":"2026-11-13T10:48:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:48:35Z","model":"claude-haiku-5-5","output":{"fix":"- Vvveb: move to `1.0.9.0` or later.","reach":"internet","title":"Vvveb: loose comparison in login cookie lets attackers take over accounts","impact":"high","summary":"Vvveb is a PHP content management system whose login cookie check uses a loose comparison on MD5 hashes. An unauthenticated attacker can brute-force a cookie value that hashes to a magic 0e string and forge a persistent cookie to take over any account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","php","self-hosted","cms"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over any account with forged persistent cookie","analyst_note":"","how_to_check":"- Check the Vvveb version in use: versions below `1.0.9.0` are listed as affected.\n- Look at `system/user/user.php` for the `generateCookie()` function and whether it compares hashes with `==`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.0.9.0-or-later"],"who_is_affected":"Sites running Vvveb before 1.0.9.0 with a publicly reachable login are exposed, since the flaw is reached without credentials. Installations on a private network or behind access control are less exposed. unknown whether other products share the code.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000715,"input_tokens":4621,"output_tokens":505,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126377':14A,17A '-2026':13A,16A '0e':58B,107C '1.0.9.0':72C 'account':11A,69B,115C 'attack':8A,45B,92C 'authent':75C 'brute':48B,95C 'brute-forc':47B,94C 'bypass':76C 'check':35B 'cms':18B 'comparison':3A,39B,85C 'comput':104C 'contain':73C 'content':29B 'cooki':6A,34B,51B,64B,89C,97C,113C 'cve':12A,15A 'forc':49B,96C 'forg':61B,111C 'generatecooki':79C 'hash':42B,54B,90C,109C 'host':23B 'let':7A 'login':5A,33B 'loos':2A,38B,84C 'magic':57B,108C 'manag':30B 'md5':41B,88C,103C 'packag':19B 'persist':63B,112C 'php':20B,28B 'self':22B 'self-host':21B 'server':101C 'string':59B 'system':31B 'system/user/user.php':81C 'take':9A,66B 'takeov':116C 'unauthent':44B,91C 'use':36B,83C 'valid':87C 'valu':52B,98C 'vulner':77C 'vvveb':1A,24B,25B,70C 'whose':32B 'yield':105C","nicknames":[],"mitigations":[],"who_affected":"Sites running Vvveb before 1.0.9.0 with a publicly reachable login are exposed, since the flaw is reached without credentials. Installations on a private network or behind access control are less exposed. unknown whether other products share the code.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","critical","package","php","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126377':14A,17A '-2026':13A,16A 'account':11A 'attack':8A 'comparison':3A 'cooki':6A 'cve':12A,15A 'let':7A 'login':5A 'loos':2A 'take':9A 'vvveb':1A","search_b":"'0e':58B 'account':69B 'attack':45B 'brute':48B 'brute-forc':47B 'check':35B 'cms':18B 'comparison':39B 'content':29B 'cooki':34B,51B,64B 'forc':49B 'forg':61B 'hash':42B,54B 'host':23B 'login':33B 'loos':38B 'magic':57B 'manag':30B 'md5':41B 'packag':19B 'persist':63B 'php':20B,28B 'self':22B 'self-host':21B 'string':59B 'system':31B 'take':66B 'unauthent':44B 'use':36B 'valu':52B 'vvveb':24B,25B 'whose':32B","search_c":"'0e':107C '1.0.9.0':72C 'account':115C 'attack':92C 'authent':75C 'brute':95C 'brute-forc':94C 'bypass':76C 'comparison':85C 'comput':104C 'contain':73C 'cooki':89C,97C,113C 'forc':96C 'forg':111C 'generatecooki':79C 'hash':90C,109C 'loos':84C 'magic':108C 'md5':88C,103C 'persist':112C 'server':101C 'system/user/user.php':81C 'takeov':116C 'unauthent':91C 'use':83C 'valid':87C 'valu':98C 'vulner':77C 'vvveb':70C 'yield':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:15:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126377","severity":null,"published_at":"2026-11-13T10:17:40+00:00","modified_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null}],"documents":[{"id":144995,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-p8w8-2rq6-wm2g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:15:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144996,"url":"https://www.vulncheck.com/advisories/vvveb-before-1.0.9.0-cookie-forgery-via-php-type-juggling-in-generatecookie","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}