Authentication Bypass Vulnerability in Pachno 1.0.6 by Pachno
CVE-2026-40043

7.1HIGH

Key Information:

Vendor

Pancho

Status
Pachno
Vendor
CVE Published:
13 April 2026

What is CVE-2026-40043?

The Pachno 1.0.6 version is vulnerable to an authentication bypass issue in the runSwitchUser() action. This flaw allows low-privilege authenticated users to escalate their privileges by manipulating the original_username cookie. Attackers can exploit this vulnerability by setting the client-controlled original_username cookie to any desired value and then requesting a switch to user ID 1. This grants them access to session tokens or password hashes of administrator accounts, posing a significant risk to the security of affected systems.

Affected Version(s)

Pachno 1.0.6

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-59...
third-party-advisory
https://www.vulncheck.com/advisories/pachno-authenticatio...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
.