Riskcovery

CVE-2026-40551

Use of Client-Side Authentication in multiple BinSoft products

State
Published
Severity
8.4 High
Published
Apr 28, 2026
Updated
Sep 30, 2026
Reserved
Apr 14, 2026

Read the record on cve.org

Description

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user.

The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Scores

CVSSScoreVectorSource
4.08.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NCERT-PL

Weaknesses

  • CWE-603 Use of Client-Side Authentication

Affected Products

ProductVersions
mpGabinetBinSoft
  • 23.12.19 and earlierAffected
mpFirmaBinSoft
  • 26.4.9 and earlierAffected
mpFakturaBinSoft
  • 26.4.9 and earlierAffected
mpFirma ERPBinSoft
  • 26.4.9 and earlierAffected
mpSekretariatBinSoft
  • 25.2.4 and earlierAffected
mpPOSBinSoft
  • 25.2.4 and earlierAffected
mpCRMBinSoft
  • 25.2.4 and earlierAffected
mpWarsztatBinSoft
  • 20.4.28 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.