CVE-2026-126377

The Vvveb software (versions before 1.0.9.0 ) is susceptible to an authentication bypass vulnerability within the generateCookie() function in system/user/user.php. The root cause is the use of loose comparison to validate MD5 cookie hashes, which is exploitable via PHP Type Juggling . An unauthe...