CVE-2026-126377
Deferred Deferred - Pending Action

Authentication Bypass in Vvveb via MD5 Hash Collision

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126377
EUVD
EUVD-2026-125188

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vvveb vvveb to 1.0.9.0 (exc)
givanz vvveb to 1.0.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Vvveb versions before 1.0.9.0. It occurs in the generateCookie() function in system/user/user.php where MD5 cookie hashes are validated using loose comparison. Attackers can brute-force cookie values until the server's MD5 hash produces a 0e magic hash, allowing them to forge persistent cookies and take over user accounts.

Detection Guidance

Check if your Vvveb installation is running a version before 1.0.9.0 by inspecting the system/user/user.php file for the generateCookie() function using loose comparison. Look for MD5 hash validation that could allow 0e magic hash bypasses.

Impact Analysis

Unauthenticated attackers can exploit this to forge valid cookies and bypass authentication, gaining unauthorized access to user accounts. This could lead to account takeover, data theft, or further compromise of the application depending on user privileges.

Mitigation Strategies

Upgrade Vvveb to version 1.0.9.0 or later immediately. Replace MD5 hashing with SHA256 or stronger algorithms in the generateCookie() function. Use strict comparison operators like hash_equals() instead of loose comparisons.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...