CVE-2026-110013: Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

Q: Which deployments are affected?

Salon Booking System versions before 10.31.9 are affected. The issue concerns booking-API access tokens issued to staff or administrator users.

Q: What does an attacker need to exploit this?

The attacker must be able to constrain the time at which a staff or administrator token was issued. They can then compute a valid token because token generation uses a hardcoded value and the issuance second rather than a secure random source.

Q: What level of access could exploitation provide?

A computed token can let the attacker access the booking API as the user whose token was issued, including as an administrator.

Published Oct 16, 2026

Updated

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.

Affected Software

1 affected component

Salon Booking System Salon Booking System<10.31.9

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Salon Booking System versions before 10.31.9 are affected. The issue concerns booking-API access tokens issued to staff or administrator users.

What does an attacker need to exploit this?

The attacker must be able to constrain the time at which a staff or administrator token was issued. They can then compute a valid token because token generation uses a hardcoded value and the issuance second rather than a secure random source.

What level of access could exploitation provide?

A computed token can let the attacker access the booking API as the user whose token was issued, including as an administrator.

CVE-2026-110013: Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What level of access could exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What level of access could exploitation provide?