Critical Authentication Bypass in Vvveb CMS Password Reset (CVE-2026-110799)
Executive & SecOps Summary
SECOPS ASSESSMENTAll websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7
Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.
Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Update: Upgrade to Vvveb CMS
v1.0.8.7or higher immediately to apply the security patch. - WAF Configuration: Implement WAF rules to inspect and block suspicious GET request sequences targeting the password reset URI.
- Access Control: Restrict access to the administrative dashboard to trusted IP addresses until the system is fully patched.
# Example: Check current version and pull latest updates
git pull origin master
# Ensure you are on version 1.0.8.7+Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
This vulnerability (CWE-287) resides in the password reset functionality of Vvveb CMS. It stems from insufficient validation of the user and token parameters passed via GET requests. An attacker can exploit this flaw to bypass the authentication process and change the password of any user without a valid token. With a CVSS score of 9.8 and an EPSS score of 0.85, this vulnerability is highly exploitable and poses a severe risk to the integrity and confidentiality of the CMS environment. Successful exploitation allows for complete site compromise.
Official Vendor Advisories & References
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.