CVE-2026-105704
Received Received - Intake

Authentication Bypass in Drug Recommendation System 1.0

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105704
EUVD
EUVD-2026-92949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SourceCodester Drug Recommendation System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105704 is a Broken Access Control vulnerability in the Drug Recommendation System 1.0. It allows attackers to bypass authentication by manipulating the user_id parameter in the Auth Guard component. The flaw occurs because the application redirects unauthenticated users without properly terminating script execution, enabling unauthorized access to sensitive functions.

Detection Guidance

Check for improper authentication in admin pages by sending direct requests to URLs without session cookies. Look for redirects without exit() calls in the code. Test for unauthorized access to sensitive endpoints like /admin/users.php or /admin/patients.php.

Impact Analysis

This vulnerability allows remote attackers to access, modify, or delete sensitive data such as user accounts, patient records, symptoms, and drug recommendations without authentication. Attackers could exploit it to steal confidential information, alter recommendations, or disrupt system operations.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and health data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health information. Exploitation could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Add exit() or die() after every header('Location: ...') redirect in admin pages. Centralize authentication checks in a shared bootstrap file or framework middleware. Validate all user sessions before processing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart