CVE-2026-10167: School Student Management System Cookie Auth Bypass

Executive Summary

A high-severity authentication bypass vulnerability (CVE-2026-10167) has been disclosed in the OUSL-GROUP BrinaryBrains School Student Management System, a PHP-based academic management platform. The flaw resides in the sign_auth_cookie function within application/controllers/Login.php, part of the MY_Controller component. Manipulation of the cookie argument can allow an attacker to bypass authentication controls.

CVSS Score: 7.3 (High)

The vulnerability was published to the NVD on May 31, 2026 and affects all versions up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6.

Vulnerability Overview

Affected Products

This is a PHP CodeIgniter-based school management application used to manage student records, academic scheduling, and administrative operations for educational institutions.

Technical Details

What Is the Vulnerability?

The vulnerability lies in the sign_auth_cookie function within the MY_Controller base controller. Authentication cookie signing in PHP applications commonly involves generating a cryptographic signature or HMAC over user-supplied session data. If the signing logic is weak — for example, relying on predictable values, failing to properly validate the cookie contents, or using insecure comparison methods — an attacker can forge or manipulate cookies to impersonate authenticated users, including administrators.

Attack Vector

1. Attacker observes or intercepts a legitimate authentication cookie
2. Crafts a manipulated cookie value exploiting the flawed sign_auth_cookie logic
3. Submits the crafted cookie to the application
4. Server-side validation accepts the forged cookie
5. Attacker gains unauthorized access as the impersonated user
6. Potential for full administrative access depending on target user role

Why PHP Cookie Auth Bugs Are High-Risk

Cookie-based authentication bypass vulnerabilities in school management systems are particularly dangerous because:

• Student and staff PII (names, contact details, grades, health information) is accessible
• Administrative accounts can modify records, grades, and enrollment data
• Many school management systems run on shared hosting with minimal security hardening
• Academic institutions often have delayed patch cycles

Impact Assessment

Recommendations

Immediate Actions

1. Audit the sign_auth_cookie function in application/controllers/Login.php — replace any weak signing logic with HMAC-SHA256 using a strong secret key
2. Rotate all session secrets and force re-authentication for all active sessions
3. Apply the latest patch or update from the OUSL-GROUP BrinaryBrains repository once released
4. Invalidate existing cookies to ensure forged sessions are terminated

Hardening Measures

- Use PHP's built-in session handling with HttpOnly and Secure cookie flags
- Implement constant-time comparison (hash_equals()) for cookie validation
- Add rate limiting and anomaly detection on login endpoints
- Enable logging for all authentication events
- Conduct a full code audit of MY_Controller and related auth logic

If Running This Software

1. Verify your commit — check if you are running a version beyond commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6
2. Monitor access logs for unexpected authenticated sessions
3. Restrict access to the admin panel by IP if possible
4. Consider a WAF rule to block suspicious cookie manipulation attempts

Detection Indicators

References

• NIST NVD — CVE-2026-10167
• OUSL-GROUP BrinaryBrains Repository