CVE-2026-101287
CriticalCVSS 9.3Summary
Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.
Risk Assessment
A remote attacker without valid credentials can manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges, obtaining a valid JWT token with administrative privileges.
Recommendation
Update Stela to version 1.60.1 or later, which validates the integrity of the “authProcess” cookie.
Related vulnerabilities
- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-108497Critical
The Amelia Booking plugin (up to 2.4.10) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker could execute arbitrary SQL queries, potentially leading to data leakage or modification.
- CVE-2026-50619Critical
A path traversal vulnerability has been reported in Qsirch, which could allow remote attackers to read unexpected files or system data. The vulnerability has been fixed in version 7.0.3.0 and later.
- CVE-2026-50612Critical
A Unix symbolic link (symlink) following vulnerability has been reported in QuMagie. If a remote attacker gains a user account, they can exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in version 2.9.2 and later.
- CVE-2026-47786Critical
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
- CVE-2026-34006Critical
A missing authentication for critical function vulnerability has been reported in sMedio DTCP MOVE, which could allow remote attackers to gain access to the system. The vulnerability has been fixed in version 1.4.5 and later.
- CVE-2026-19863Critical
In EthereumAuthenticator, an unauthenticated client may access certain protected resources if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page, which may replace authentication or role requirements with ALLOWED.
- CVE-2026-16438Critical
Mitsubishi Electric products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64) versions 10.97.3 and prior contain an incorrect privilege assignment vulnerability. Installers grant default DCOM permissions to the administrator account, allowing an attacker to locally or remotely launch and operate DCOM objects that should require UAC elevation.
- CVE-2026-16436Critical
Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.
- CVE-2026-102469Critical
The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.
Original NVD description (English source)
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process. A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS