CVE WatchSep 30, 2026

CVE-2026-40551

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend s

CVSS

—

No CVSS

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Apr 28, 2026 · Last modified: Sep 30, 2026 · CWE-603

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-09-242026-10-23

Technical description

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-909838.2 HIG

16.8%

——5Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.14d CVE-2026-30964.7 MED

20.2%

——6The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.35d CVE-2026-663057.1 HIG

43.8%

——13Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.37d CVE-2026-769457.5 HIG

42.2%

——13The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.53d CVE-2026-711879.8 CRI

55.5%

——17The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.53d CVE-2026-88304.3 MED

37.2%

——11A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.92d