PT-2026-133450

CVE-2026-110972

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 4.0
8.6
High
MetricsAV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.
This issue was fixed in metric 242 in version 10.02.002.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-603: Use of Client-Side Authentication
Related identifiers
CVE-2026-110972
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com