CVE-2026-112205: Bruteforce Protection Bypass in WidzialniCMS

Q: What access does an attacker need to exploit this issue?

No authentication is required. An attacker can bypass the cookie-based lockout by omitting the login_count and login_timeout cookies and then make unlimited login attempts.

Q: Which deployments are affected?

Deployments using the vulnerable login functionality are affected where lockout enforcement relies on the login_count and login_timeout cookies. The issue is fixed in WidzialniCMS version 2.5.

Q: What should teams do if they cannot immediately upgrade?

The provided information does not identify a workaround. Prioritize upgrading to version 2.5 and monitor for unusually high volumes of failed login attempts in the meantime.

Published Nov 9, 2026

Updated

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the logincount and logintimeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.

This issue has been fixed in version 2.5.

Affected Software

1 affected component

WidzialniCMS<2.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WidzialniCMS to a version that resolves this vulnerability.
Fixed in 2.5

Event History

Nov 9, 2026

CVE Published

via MITRE·12:49 PM

Data Sourced

via MITRE·12:49 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

No authentication is required. An attacker can bypass the cookie-based lockout by omitting the login_count and login_timeout cookies and then make unlimited login attempts.

Which deployments are affected?

Deployments using the vulnerable login functionality are affected where lockout enforcement relies on the login_count and login_timeout cookies. The issue is fixed in WidzialniCMS version 2.5.

What should teams do if they cannot immediately upgrade?

The provided information does not identify a workaround. Prioritize upgrading to version 2.5 and monitor for unusually high volumes of failed login attempts in the meantime.

CVE-2026-112205: Bruteforce Protection Bypass in WidzialniCMS

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What should teams do if they cannot immediately upgrade?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What should teams do if they cannot immediately upgrade?