CVE-2026-19974
treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication
- State
- Published
- Severity
- 6.3 Medium
- Published
- Aug 17, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 16, 2026
Description
A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.6 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.6 Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.1 Medium | AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
treefrog-frameworktreefrogframework |
|
References
- VDB-391153 | treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authenticationvdb-entrytechnical-description
- VDB-391153 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-19974 | CVE Analysis and Reportthird-party-advisory
- Submit #873625 | treefrogframework TreeFrog Framework 2.9.0 through 2.11.2 (inclusive) Improper Verification of Cryptographic Signaturethird-party-advisory
- https://github.com/theopaid/Authentication-Bypass-via-HMAC-Session-Cookie-Forgery-treefrog-framework-exploit
- https://github.com/treefrogframework/treefrog-framework/issues/436issue-tracking
- https://github.com/treefrogframework/treefrog-framework/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.