Givanz Vvveb up to 1.0.8.7 Cookie Validation system/user/user.php generateCookie weak password hash

Summaryinfo

A vulnerability, which was classified as problematic, was found in Givanz Vvveb. Affected is the function generateCookie of the file system/user/user.php of the component Cookie Validation. Executing a manipulation can lead to weak password hash. This vulnerability is tracked as CVE-2026-126377. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Givanz Vvveb. It has been declared as problematic. This vulnerability affects the function generateCookie of the file system/user/user.php of the component Cookie Validation. The manipulation with an unknown input leads to a weak password hash vulnerability. The CWE definition for the vulnerability is CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. As an impact it is known to affect confidentiality. CVE summarizes:

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-126377 since 11/10/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

By approaching the search of inurl:system/user/user.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.9.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1
• 1.0.8.2
• 1.0.8.3
• 1.0.8.4
• 1.0.8.5
• 1.0.8.6
• 1.0.8.7

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion