{"id":"CVE-2026-110799","published":"2026-10-30T15:16:44.787","lastModified":"2026-10-30T16:17:37.630","description":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj","tags":[]},{"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj","tags":[]}],"exploitRefs":[{"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj","tags":[]},{"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj","tags":[]}],"hasPoc":true,"ai":{"summary":"The password reset functionality in Vvveb CMS prior to version 1.0.8.7 allows unauthenticated attackers to bypass authentication by exploiting insufficient validation of the 'user' and 'token' GET parameters, enabling unauthorized account access.","exploitability":"Exploitation is straightforward for remote attackers with no authentication or user interaction required, as it relies on predictable parameter manipulation.","blast_radius":"Successful exploitation grants full account takeover, leading to potential data theft, unauthorized content modification, and full system compromise.","remediation":"Upgrade to Vvveb CMS version 1.0.8.7 or later, which contains the official patch for this authentication bypass vulnerability.","detection":"Look for repeated or anomalous requests to the password reset endpoint (e.g., /reset-password) with missing, invalid, or reused token values in web server logs; however, no reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","webapp","cms","password-reset","cwe-287"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:30.821Z"}}