{"id":"CVE-2026-105133","url":"https://compromised.live/t/CVE-2026-105133","kind":"exploited_vuln","tier":2,"severity":"high","title":"Ahsay AhsayCBS: Ahsay AhsayCBS Improper Authentication Vulnerability","summary":"A remote attacker can bypass login checks in AhsayCBS by manipulating a parameter sent to its API, and this flaw is being actively exploited in the wild. Ahsay AhsayCBS; no fixed versions are listed, so this applies to all AhsayCBS deployments. Apply the vendor's update now and check for signs of compromise, including unexpected admin logins or new accounts.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-14","due_date":"2026-10-17","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","aliases":["CVE-2026-105133"],"sources":[{"name":"kev","id":"CVE-2026-105133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133"}]}