dbcve.org
Improper AuthenticationWeakness · CWE-287

CVE-2026-10167

HIGH · 7.3 CVSS v3.1 Published 2026-05-31
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
82/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A weakness has been identified in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. This impacts the function sign_auth_cookie of the file application/controllers/Login.php of the component MY_Controller. Executing a manipulation of the argument role can lead to improper authentication. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Authentication bypass vulnerability in the sign_auth_cookie function of Login.php within the MY_Controller component of OUSL-GROUP-BrinaryBrains School Student Management System. The function improperly validates the role argument, allowing attackers to manipulate this parameter to bypass authentication controls and gain unauthorized access.

MitigationImplement proper server-side validation and cryptographically secure handling of the role parameter in sign_auth_cookie. Ensure role values are validated against a strict whitelist from trusted sources before any authentication decisions are made.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate Login.php in the application
    Search the codebase for the file Login.php (e.g., find . -name Login.php, grep -r 'Login.php' or review application file structure)
    Affected if Login.php exists and handles authentication logic
  2. Identify the sign_auth_cookie function
    Open Login.php and search for the function definition 'function sign_auth_cookie' or similar
    Affected if The sign_auth_cookie function exists in Login.php and is used for cookie generation
  3. Inspect how the role parameter is obtained
    Within sign_auth_cookie, examine how the role parameter is received - look for direct assignment from $_POST, $_GET, $_COOKIE, or other client-supplied input
    Affected if The role value is read directly from client input without server-side derivation
  4. Check if role is used without server-side validation
    Trace how the role value is used after being obtained - verify if it is passed directly to cookie creation or session setting without comparing against trusted server-side user data
    Affected if The client-supplied role value is trusted and used directly for authentication decisions without server-side verification
  5. Verify if cookie generation trusts client role
    Examine the sign_auth_cookie output - confirm whether the generated authentication cookie contains the client-supplied role value verbatim
    Affected if The authentication cookie embeds the unvalidated client-supplied role, allowing attackers to forge cookies with elevated privileges

Your environment is affected if Login.php contains a sign_auth_cookie function that derives the role value from client-supplied input (such as request parameters or cookies) rather than from server-side session or database records.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Implement proper server-side validation and cryptographically secure handling of the role parameter in sign_auth_cookie. Ensure role values are validated against a strict whitelist from trusted sources before any authentication decisions are made.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-10167 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-10167 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data