CVE-2026-124575: SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiteServer SSCMSto a version that resolves this vulnerability.Patch df3becb7ebb00a48435418a44fd08a459eb38ace
Event History
Frequently Asked Questions
Which deployments are affected?
SiteServer SSCMS versions up to 7.1.3, 7.2.1, and 7.4.0 are identified as affected. The issue is in the Admin-Login CAPTCHA component's LoginController.Submit function.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation is assessed as difficult and has high attack complexity because it involves manipulating the isForceLogoutAndLogin argument.
What is the security impact?
The flaw can improperly restrict protections against excessive authentication attempts, with a low severity score of 3.7. The reported impact is limited to confidentiality; no integrity or availability impact is specified.
What should teams do to remediate the issue?
Apply the vendor patch identified as df3becb7ebb00a48435418a44fd08a459eb38ace. The provided data does not specify a workaround if patching cannot be performed immediately.