Authentication Bypass Vulnerability in Stela by Diaple Networking
CVE-2026-101287

9.3CRITICAL

Key Information:

Vendor

Diaple

Status
Stela
Vendor
CVE Published:
15 October 2026

What is CVE-2026-101287?

An authentication bypass vulnerability exists in Stela versions prior to 1.60.1, caused by the improper validation of the 'authProcess' cookie. The application relies on this cookie to store user identifiers and authentication status, allowing clients to modify the values. An attacker could exploit this by manipulating the cookie to bypass authentication processes and impersonate any user, including those with SUPER_ADMIN privileges. This manipulation could lead to unauthorized access and a compromise of the application’s confidentiality and integrity.

Affected Version(s)

Stela versions prior to 1.60.1

References

https://www.incibe.es/en/incibe-cert/notices/aviso/authen...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Xavi Márquez Gonzalez
.