CVE-2026-105133
Received Received - Intake

Improper Authentication in AhsayCBS via Random Parameter Manipulation

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105133
EUVD
EUVD-2026-92079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ahsay ahsaycbs to 10.3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105133 is an improper authentication vulnerability in AhsayCBS up to version 10.3.2. It exists in the function checkSysPwd in the file com/ahsay/obs/api/ApiStructsAction.java. The vulnerability allows remote attackers to manipulate the random argument to bypass authentication.

Detection Guidance

The vulnerability affects AhsayCBS up to version 10.3.2 in the API component. Detection involves checking the installed version of AhsayCBS. If the version is 10.3.2 or earlier, the system is vulnerable. No specific commands are provided in the context, but verifying the software version is the primary detection method.

Impact Analysis

This vulnerability enables remote attackers to gain unauthorized access to the AhsayCBS system without proper authentication. Attackers could exploit it to perform unauthorized actions, access sensitive data, or disrupt services. The exploit is public, increasing the risk of active attacks.

Compliance Impact

Improper authentication can lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. This may result in legal penalties, loss of compliance certifications, and reputational damage for organizations using the affected software.

Mitigation Strategies

Upgrade AhsayCBS to version 10.3.4 or later to mitigate the vulnerability. The context does not provide specific commands for upgrading, but following the official release notes and installation instructions from Ahsay is recommended.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart