CVE-2026-71809

HighCVSS 8.1

Published: 09/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

In Siam Ordering (siam-server) version 1.0.0, there is an authentication bypass vulnerability via a hardcoded master verification code. Remote unauthenticated attackers can log in as any user, merchant, or administrator.

Risk Assessment

An attacker can gain full control of the system, including access to user data, orders, and administrative functions, posing a serious threat to confidentiality and integrity.

Recommendation

It is recommended to immediately update Siam Ordering to a version that removes the hardcoded code, or implement additional authentication mechanisms.

Other vulnerabilities in Siam Ordering

CVE-2026-71808High
A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

Original NVD description (English source)

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS