Zero Radar
← feed
CriticalVulnerabilityCVE-2026-110799updated 30 Oct 2026, 15:18 UTC

Vvveb CMS password reset flaw lets attackers bypass login

A weakness in the password reset page of the Vvveb website builder could let someone take over an account without knowing its password. Updating the software closes the hole.

Fixed in Vvveb CMS 1.0.8.7 and later · out Official source
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVvveb CMS 1.0.8.7 and later · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

What happened

The password reset functionality in Vvveb CMS does not properly validate the 'user' and 'token' GET parameters, enabling an authentication bypass.

Why it is dangerous: An attacker could gain access to user accounts, including administrator accounts, and control the website's content and settings.

Are you affected?

You are affected if you run Vvveb CMS older than version 1.0.8.7.

Vvveb CMS versions prior to 1.0.8.7

What to do

  1. Update Vvveb CMS to version 1.0.8.7 or later
  2. Review user accounts and recent password reset activity for signs of unauthorized access
  3. Check the site for unexpected admin users or content changes

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-110799
CVSS
9.8 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Vvveb CMS password reset flaw lets attackers bypass login · Zero Radar