CVE-2026-48518

Name of the Vulnerable Software and Affected Versions MultiJuicer versions 8.0.0 through 10.0.0

Description The team join endpoint 'POST /multi-juicer/api/teams/{team}/join' accepts requests with any Content-Type, including text/plain. Since this content type does not trigger a Cross-Origin Resource Sharing (CORS) preflight—a mechanism used by browsers to verify if a cross-site request is safe—an attacker can use a cross-site HTML form to force a victim's browser to log in as the attacker's team. This allows an attacker to inflate their team score in a Capture The Flag (CTF) context by using other players' activity and capture sensitive data entered by the victim. The issue is exploitable without authentication if the victim visits an attacker-controlled page while having network access to the deployment. The use of SameSite=Strict on session cookies does not prevent this attack because it plants a new cookie instead of using an existing one.

Recommendations Update to version 10.0.1.