CVE-2026-1203
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| crmeb | crmeb | to 5.6.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1203 is an authentication bypass vulnerability in CRMEB versions up to 5.6.3. It occurs in the remoteRegister function of the JSON Token Handler component, where the system improperly processes JSON Web Tokens (JWTs) by decoding them without verifying their cryptographic signatures. This allows an attacker to forge arbitrary tokens and manipulate the uid argument to bypass authentication, enabling them to create fake accounts or log in as any user without proper credentials. [2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to bypass authentication remotely with a high level of complexity. They can create unlimited fake accounts or log in as any existing user by specifying any user ID, compromising the confidentiality, integrity, and availability of your system. This could lead to unauthorized access, data breaches, and potential disruption of services. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by searching for the vulnerable endpoint in your system or network, specifically the remoteRegister function in crmeb/app/services/user/LoginServices.php. One suggested method is using Google dorking with queries like 'inurl:crmeb/app/services/user/LoginServices.php' to locate vulnerable targets. Additionally, monitoring for unusual authentication attempts or creation of fake accounts via manipulation of the uid parameter may indicate exploitation attempts. Specific commands are not provided in the resources. [3]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been identified for this vulnerability. It is suggested to replace the affected component or product (CRMEB up to version 5.6.3) to mitigate the risk. Since the vendor has not responded, upgrading to a non-vulnerable version or applying custom patches to ensure proper JWT signature verification would be advisable. [3]