Bruteforce Protection Bypass Vulnerability in WidzialniCMS by Widzialni
CVE-2026-112205

6.9MEDIUM

Key Information:

Vendor

Fundacja Widzialni

Status
Widzialnicms
Vendor
CVE Published:
9 November 2026

What is CVE-2026-112205?

WidzialniCMS has a vulnerability in its login functionality that allows attackers to bypass cookie-based lockout mechanisms. By omitting the 'login_count' and 'login_timeout' cookies, an unauthenticated attacker can exploit this flaw to execute an unlimited number of login attempts, potentially compromising user accounts. This issue was addressed in version 2.5 of WidzialniCMS.

Affected Version(s)

WidzialniCMS 0 < 2.5

References

https://cert.pl/posts/2026/11/CVE-2026-110468
third-party-advisory
https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg...
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mikołaj Matuszewski (CERT.PL)
.