Executive Summary

CVE-2026-8244 is a vulnerability in Canias ERP that allows unauthorized access to sensitive user information through an empty login request.

When a login attempt is made with empty credentials (username and password left blank), the server incorrectly responds with a "USERWRONGPASSWORD" message but still leaks detailed user data in the response payload.

• Leaked data includes the user's name, security key, session ID, menu tree, and other profile details.

The attack exploits the Java Remote Method Invocation (RMI) interface, where the binding name and client version are automatically resolved.

The server requires an exact client version match; otherwise, it returns a "VERSION_INCONSISTENCY" error without data leakage.

The proof-of-concept code demonstrates how to exploit this by fetching the RMI binding name from the JNLP endpoint or registry, retrieving the correct client version, and sending empty login requests to extract user data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to sensitive user information without authentication.

• Attackers can retrieve user names, security keys, session IDs, menu trees, and other profile details.

Such unauthorized data exposure can lead to further attacks, identity theft, session hijacking, or unauthorized system access.

Since the exploit can be initiated remotely and is publicly available, the risk of exploitation is significant.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending empty login requests to the Canias ERP server's Java RMI interface and observing the responses. Specifically, sending three empty login attempts (with blank username and password) may cause the server to leak sensitive user information such as user names, security keys, session IDs, and profile details in the response payload.

Detection involves fetching the RMI binding name from the JNLP endpoint or registry, retrieving the correct client version string, and then sending empty login requests to test for data leakage.

A proof-of-concept approach includes commands or scripts that perform these steps to verify if the server responds with detailed user data despite authentication failure.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Canias ERP allows unauthorized access to sensitive user information without authentication by exploiting the login RMI interface. This unauthorized data exposure includes user names, security keys, session IDs, and profile details.

Such unauthorized disclosure of sensitive personal and security-related information can lead to non-compliance with common data protection standards and regulations like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive data.

Therefore, this vulnerability poses a risk to compliance by potentially enabling data breaches and unauthorized data access, which are violations of these regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, it is recommended to restrict or disable access to the Login RMI Interface if possible, especially from untrusted networks.

Monitor and block suspicious login attempts that involve empty credentials, as these are used to exploit the vulnerability.

Implement network-level controls such as firewall rules or VPN requirements to limit remote access to the affected service.

Since the vendor has not responded with a patch or fix, consider applying additional application-level authentication or input validation to prevent empty login requests.

Regularly audit logs for unusual activity related to the RMI interface and user data access.

Useful 0 Not Useful 0