CVE-2026-86669

Deferred Deferred - Pending Action

Authentication Bypass in iWebShop via Name Parameter

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-86669

Affected Vendors & Products

Vendor	Product	Version / Range
aircheng-org	iwebshop	to 5.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in the aircheng-org iWebShop-5 software up to version 5.15. It exists in the Login function of the controllers/systemseller.php file. An attacker can manipulate the Name argument to bypass authentication, allowing remote access without proper credentials. The exploit is publicly available.

Impact Analysis

This vulnerability allows unauthorized remote attackers to gain access to the system by bypassing authentication. This could lead to data breaches, unauthorized transactions, or system compromise. The public availability of the exploit increases the risk of widespread attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using this software may face compliance failures, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update iWebShop to the latest version if available. If no update exists, disable the Login function in controllers/systemseller.php or restrict access to it. Monitor network traffic for unauthorized authentication attempts.

Hi! I’m here to help you understand CVE-2026-86669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70