CVE-2026-126377: Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Vvveb versions before 1.0.9.0 are affected. The issue is reachable remotely and does not require an existing account or user interaction.
What does an attacker need to exploit it?
An attacker needs to brute-force cookie values until the server's MD5 calculation produces a value matching the PHP 0e magic-hash condition. No privileges or user interaction are required.
What is the likely impact of successful exploitation?
Successful exploitation allows forging persistent authentication cookies and can result in account takeover. The reported impact includes compromise of confidentiality, integrity, and availability.