Read the docs
TI-2026-83112 Aliases CVE-2026-110799

Authentication bypass in Vvveb password reset enables account takeover

Priority HIGH 82CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Vvveb versions before 1.0.8.7, a CMS by givanz, are affected. The password reset function does not sufficiently validate the user and token GET parameters, which is an improper authentication flaw (CWE-287). An unauthenticated remote attacker can bypass authentication through the reset process and take over accounts, with high impact to confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00708 53rd percentileScored 2026-11-07
Fix Fixed Vvveb (givanz): 1.0.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
givanzVvvebbefore 1.0.8.71.0.8.7Patch availableCNA
  • Vvveb Vendorgivanz Affected before 1.0.8.7 Fixed in 1.0.8.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*——givanz
  • cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:* Versions — — ·givanz

Remediation

Update Vvveb to version 1.0.8.7, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Vvveb (givanz) Fixed in 1.0.8.7

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-110799
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → HIGH

References

Other 1

  • TI-2025-28570 An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. CVSS 3.1CRITICAL 9.8
  • TI-2024-18282 givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. CVSS 3.1CRITICAL 9.8
  • TI-2024-16622 givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. CVSS 3.1CRITICAL 9.8
  • TI-2024-16621 A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both… CVSS 3.1CRITICAL 9.1
  • TI-2026-83115 Authenticated IDOR in Vvveb lets admins steal other admins' API tokens CVSS 3.1CRITICAL 9.0
  • TI-2026-79725 Path traversal in Vvveb backup controller exposes server files CVSS 3.1HIGH 8.7
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences