CVE-2025-8350

Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS

State: Published
Severity: 9.8 Critical
Published: Feb 19, 2026
Updated: Jun 5, 2026
Reserved: Jul 30, 2025

Description

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.

This issue affects BiEticaret CMS: from 2.1.13 through 19022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	TR-CERT

Weaknesses

CWE-698 Execution After Redirect (EAR)
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
BiEticaret CMSInrove Software and Internet Services	2.1.13 through 19022026Affected

References

https://www.usom.gov.tr/bildirim/tr-26-0077government-resourcebroken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0077government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.