CVE-2026-101287
Received Received - Intake

Authentication Bypass in Stela via Unsigned AuthProcess Cookie

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process. A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-101287
EUVD
EUVD-2026-101949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Diaple Stela versions prior to 1.60.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authentication bypass vulnerability in Stela software versions before 1.60.1. It occurs because the application uses a cookie named 'authProcess' that stores user identifiers and authentication status without verifying if the cookie has been tampered with. Attackers can modify this cookie to bypass login checks and impersonate any user, including administrators.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests containing the 'authProcess' cookie. Check if the cookie values for 'userId' and 'validSteps' can be modified without server-side validation. Monitor for unauthorized JWT token generation or administrative access attempts.

Impact Analysis

An attacker could exploit this to gain unauthorized access to your Stela application without valid credentials. They could impersonate any user account, including those with administrative privileges, and obtain a valid JWT token to perform actions with full system access. This compromises the confidentiality and integrity of your application and data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, or improper access to protected health or personal information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Immediately update Stela to version 1.60.1 or later to address the authentication bypass. Disable or restrict access to the application until the update is applied. Review logs for suspicious activity related to cookie manipulation or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart