/Vulnerability Library

AhsayCBS - JSON API Authentication Bypass

CVE-2026-105133
Verified

Description

Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.

Severity

Medium

CVSS Score

7.3

Exploit Probability

84%

Affected Product

ahsaycbs

Published Date

October 21, 2026

Template Author

alex

CVE-2026-105133.yaml
7.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE ID:
cve-2026-105133
CWE ID:
cwe-287

References

https://www.ahsay.com/en/company/announcementshttps://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCEhttps://nvd.nist.gov/vuln/detail/CVE-2026-105133

Remediation Steps

Upgrade to version 10.3.4.