CVE-2026-110972: Use of Client-Side Authentication in Płatnik
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.
This issue was fixed in metric 242 in version 10.02.002.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Płatnikto a version that resolves this vulnerability.Fixed in 10.02.002Patch metric 242
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to any Płatnik application instance that is connected to the backend server. No existing user privileges or user interaction are required according to the supplied vector.
What can an attacker do after exploiting it?
The attacker can bypass login verification and authenticate as an arbitrary user. This can affect confidentiality and integrity at a high level, with a lower impact on availability.
Which release fixes the issue?
The issue was fixed in metric 242 in Płatnik version 10.02.002.