CVE-2026-110799: Vvveb Password Reset Authentication Bypass
A critical vulnerability has been published for Vvveb, an open-source CMS with a page builder used for websites, blogs, and ecommerce stores. Tracked as CVE-2026-110799 with a CVSS score of 9.8, the flaw lets an unauthenticated remote attacker bypass the password reset flow and take over accounts.
The issue was published on 2026-10-30 and is fixed in Vvveb 1.0.8.7.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-110799 |
| CVSS Score | 9.8 (Critical) |
| CWE Classification | CWE-287 Improper Authentication |
| Affected Product | Vvveb CMS (givanz/Vvveb) |
| Affected Versions | Versions before 1.0.8.7 |
| Fixed Version | 1.0.8.7 |
| Authentication Required | None |
| Published | 2026-10-30 |
| CISA KEV | Not listed at time of writing |
Technical Analysis
The password reset functionality does not sufficiently validate the user and token GET parameters. Public vulnerability records describe the bug as an authentication bypass via PHP array injection: PHP accepts array-typed values for query parameters (for example token[]=), and when the application compares or uses the value without enforcing that it is a string, the token check can be defeated.
Exploitation requires only network access to the reset endpoint. No credentials or user interaction are needed, and a successful attack can lead to full account takeover, including administrator accounts.
Remediation
- Upgrade Vvveb to 1.0.8.7 or later as soon as possible.
- If you cannot upgrade immediately, restrict access to the password reset endpoint and the admin area by IP or behind a reverse proxy with authentication.
- Review administrator accounts and recent password resets for unexpected changes.
- Rotate admin passwords and any API tokens on instances that were exposed to the internet while running a vulnerable version.
Detection
Review web server logs for reset requests carrying array-style parameters:
grep -E "token(\[|%5B)" /var/log/nginx/access.log | tail -50
grep -E "user(\[|%5B)" /var/log/nginx/access.log | tail -50Related Vulnerability
Vvveb 1.0.8.7 also fixes an authenticated IDOR in the admin API token endpoint, tracked as CVE-2026-112905. Patching to 1.0.8.7 addresses both.
Key Takeaways
- CVE-2026-110799 is an unauthenticated, CVSS 9.8 authentication bypass in Vvveb's password reset flow
- All versions before 1.0.8.7 are affected
- Upgrade to 1.0.8.7 and audit admin accounts for signs of takeover
- No active exploitation has been confirmed in CISA KEV, but unauthenticated account takeover bugs are quickly weaponized