CVE-2026-126371: Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in AdminAuthTokenSQL::update(), which interpolates adminauthtoken array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Vvveb admin panel. The affected request is the admin/auth-token save action, so unauthenticated users are not described as able to exploit it.
What input is required for exploitation?
The attacker needs to submit crafted admin_auth_token array keys containing backticks. Those keys are interpolated into the SQL INSERT column list without a column whitelist or backtick escaping.
How can I determine whether my deployment is affected?
Deployments running Vvveb through version 1.0.8.6 are identified as affected. Review access to the admin panel and the admin/auth-token save action, particularly whether untrusted or insufficiently trusted users have authenticated administrative access.