CVE-2026-111874
Deferred Deferred - Pending Action

Authentication Bypass in OpenCATS Career Portal

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111874
EUVD
EUVD-2026-103385

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a OpenCATS 0.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-799 The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenCATS 0.10.0 Career Portal. It allows remote attackers to bypass authentication by manipulating the applyToJobSubAction argument in the processLogin function. The flaw stems from improper restriction of excessive authentication attempts due to missing rate limiting and CAPTCHA protection. Attackers can exploit low-entropy verification triples (email, last name, ZIP code) stored in client-side cookies to access or modify candidate profiles without further authentication.

The vendor fixed this by removing persistent client-side cookies, enforcing CAPTCHA for each login, and maintaining server-side candidate authentication. Rate limiting remains out of scope and is recommended to be handled at the network or web-server level.

Detection Guidance

To detect this vulnerability, monitor for excessive authentication attempts or repeated requests to the Career Portal login endpoint. Check for the presence of the client-side cookie 'cats1cw' storing candidate credentials. Use tools like curl to test the login flow for missing CAPTCHA or rate limiting. Example: curl -v -c cookies.txt -b cookies.txt 'http://target/opencats/index.php?m=careers&a=processLogin' to inspect cookie handling and responses.

Impact Analysis

Unauthenticated attackers could enumerate candidate identities and access or modify sensitive profile data by exploiting weak verification triples stored in cookies. This could lead to unauthorized access to personal information, profile changes, or application submissions. The attack requires some complexity but is feasible with published exploits.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through unauthorized access to candidate profiles. For HIPAA, if candidate data includes protected health information, the lack of access controls and rate limiting could lead to breaches. Compliance requires implementing the vendor's patch and additional network-level rate limiting to protect sensitive data.

Mitigation Strategies

Apply the provided patch (1cf4fa3ee9054314b023be79d404078645c22ade) to remove client-side credential storage and enforce CAPTCHA. Configure network-level rate limiting (5-10 login attempts per minute per IP) using nginx, Apache, or Cloudflare. Ensure server-side session management and ignore old authentication cookies. Remove any 'Remember me' functionality from frontend templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111874. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart