CVE-2026-109114
Received Received - Intake

Authentication Bypass in Restaurant-Management-System

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109114
EUVD
EUVD-2026-98326

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the Restaurant-Management-System. The login system checks the user table first for valid credentials. If no match is found, it silently falls back to checking the admin table. If an admin's credentials are matched, the system logs the user in as a super-admin without additional checks, granting full admin access via the public login page.

Detection Guidance

Check the User/login.php file for improper authentication logic where the system falls back from the user table to the admin table without additional checks. Look for session variable manipulation like $_SESSION['user'] and $_SESSION['id'] being set without proper validation.

Impact Analysis

An attacker can exploit this to gain unauthorized super-admin access by using valid or guessed admin credentials. This allows them to manage menus, tables, orders, and user data, including viewing plaintext passwords. The impact includes potential data breaches, unauthorized modifications, and full control over the restaurant management system.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data, including plaintext passwords. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. The breach could lead to legal penalties, fines, and reputational damage.

Mitigation Strategies

Disable the fallback mechanism in User/login.php that checks the admin table after the user table fails. Ensure session variables are set only after strict validation of credentials. Monitor for unauthorized admin-level access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart