CVE-2026-105133: Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 10.3.4
Event History
Frequently Asked Questions
Which deployments are affected?
Ahsay AhsayCBS versions up to and including 10.3.2 are affected. The issue is in the API component, specifically the checkSysPwd function in ApiStructsAction.java.
Can this be exploited without credentials or user interaction?
Yes. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction. Exploitation involves manipulating the API argument named random.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is public and may be used, increasing the urgency of remediation for exposed API instances.
What remediation is available?
Upgrade Ahsay AhsayCBS to version 10.3.4, which is identified as mitigating the issue. The provided information does not specify an alternative workaround if an upgrade cannot be performed immediately.