Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-86306: light0011 CMS allows login bypass via username field

CVE-2026-86306 · published 1 month ago

Summary

The user login code in light0011 CMS does not properly verify the username, so an attacker can trick the system into accepting an invalid login. This can be done from anywhere on the internet and could let unauthorized users access the site. Apply the latest updates from the project or modify the code to enforce strict username checks as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
light0011	cms	c774dce31c6df0055568a8d5c53d964d99be199d

Original advisory text

light0011 cms Cookie Helper UserModel.class.php improper authentication

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86306... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86306 Vendor Advisory
https://vuldb.com/vuln/399479 Vendor Advisory
https://vuldb.com/vuln/399479/cti Third Party Advisory
https://github.com/light0011/cms/ URL
https://vuldb.com/cve/CVE-2026-86306 Vendor Advisory
https://vuldb.com/submit/894817 Vendor Advisory
https://github.com/light0011/cms/issues/11 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published7 Sep 2026

Updated4 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-86306 · NVD

CVE-2026-86306 · MITRE

CVE-2026-86306 · OSV

Track software like this

Free during beta