AhsayCBS - JSON API Authentication Bypass

Ahsay AhsayCBS = 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation. id: CVE-2026-105133 info: name: AhsayCBS - JSON API...

Vulnerabilities hidden in Ahsay AhsayCBS

Ahsay has fixed vulnerabilities in AhsayCBS up to version 10.3.2. The vulnerability with identifier CVE-2026-105133 has a CVSS score of 7.3 and involves insufficient authentication in the checkSysPwd function of the AhsayCBS API. An unauthorized malicious actor could exploit this vulnerability to...

Ahsay AhsayCBS Improper Authentication Vulnerability

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 CVSS v4 score: 5.5 - An improper authentication...

VulnCheck KEV: CVE-2026-105133

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134...

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

EUVD-2026-92079

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

CVE-2026-105133

Ahsay AhsayCBS versions up to 10.3.2 are vulnerable to improper authentication in the checkSysPwd function of the com/ahsay/obs/api/ApiStructsAction.java file within the API component. Attackers can bypass authentication by manipulating the random argument, allowing unauthenticated remote access ...

CVE-2026-105133: Improper Authentication

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...

PT-2026-104607

Name of the Vulnerable Software and Affected Versions Ahsay AhsayCBS versions prior to 10.3.4 Description An issue in the API component allows remote attackers to bypass authentication by manipulating the random argument within the checkSysPwd function of the com/ahsay/obs/api/ApiStructsAction.ja...