Improper Authentication Attempts in SiteServer SSCMS Affecting Multiple Versions
CVE-2026-124575

6.3MEDIUM

Key Information:

Vendor

Siteserver

Status
Sscms
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124575?

A vulnerability has been detected in SiteServer SSCMS, where the LoginController.Submit function fails to impose adequate restrictions on multiple authentication attempts during remote login processes. This flaw specifically arises from improper manipulation of the isForceLogoutAndLogin argument within the Admin-Login CAPTCHA component. Attackers could exploit this vulnerability to bypass intended security mechanisms, leading to excessive login attempts. Recommended remedial action includes applying the patch identified by the commit hash df3becb7ebb00a48435418a44fd08a459eb38ace to mitigate this issue effectively.

Affected Version(s)

SSCMS 7.0

SSCMS 7.1

SSCMS 7.1.0

References

https://vuldb.com/vuln/432921
vdb-entrytechnical-description
https://vuldb.com/vuln/432921/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124575
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The_S7s (VulDB User)
.