CVE-2026-110972
Use of Client-Side Authentication in Płatnik
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 15, 2026
Description
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.
This issue was fixed in metric 242 in version 10.02.002.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-603 Use of Client-Side authentication
Affected Products
| Product | Versions |
|---|---|
PłatnikZakład Ubezpieczeń Społecznych |
|
References
- https://cert.pl/posts/2026/10/CVE-2026-110970third-party-advisory
- https://www.zus.pl/firmy/program-platnik/o-programie-platnikproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.