CVE-2026-1202
CRMEB LoginController.php appleLogin improper authentication
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jan 20, 2026
- Updated
- Feb 23, 2026
- Reserved
- Jan 19, 2026
Description
A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
CRMEBn/a |
|
References
- VDB-341788 | CRMEB LoginController.php appleLogin improper authenticationvdb-entrytechnical-description
- VDB-341788 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #734711 | Zhongbang CRMEB v5.6.3 Improper Authenticationthird-party-advisory
- https://github.com/foeCat/CVE/blob/main/CRMEB/apple_login_auth_bypass.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.