CVE-2026-40551

HighCVSS 8.4

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. The issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Risk Assessment

Complete authentication bypass, which can lead to unauthorized access to data and systems. The attack requires access to an application instance, but no special privileges.

Recommendation

Contact the vendor to obtain the corrected installation manual and implement it. Consider additional security measures such as server-side multi-factor authentication.

Other vulnerabilities in BinSoft

CVE-2026-40550Medium
Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application's memory by inspecting the running process. The exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This affects all published versions, and the vendor will mitigate it with a corrected installation manual.

Original NVD description (English source)

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS