CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
Other sources
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
— MITRE
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 10.3.4 - Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 9.15.2.70 - Upgrade
Upgrade
Ahsay AhsayCBSto a version that resolves this vulnerability.Fixed in 10.3.4.45
Event History
Frequently Asked Questions
Which deployments are affected?
Ahsay AhsayCBS versions up to and including 10.3.2 are affected. The issue is in the API component, specifically the checkSysPwd function in ApiStructsAction.java.
Can this be exploited without credentials or user interaction?
Yes. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction. Exploitation involves manipulating the API argument named random.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is public and may be used, increasing the urgency of remediation for exposed API instances.
What remediation is available?
Upgrade Ahsay AhsayCBS to version 10.3.4, which is identified as mitigating the issue. The provided information does not specify an alternative workaround if an upgrade cannot be performed immediately.