MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

Advisories

MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

Severity: critical
Date: 10/15/2026
Affecting: MacCMS <= 2026.1000.4056
CVE: CVE-2026-111356
CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
CVSS: 9.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover
https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231
https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450
https://github.com/magicblack/maccms10
Credit: hieuPenguinnn
Description: MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo