Client-Side Authentication Vulnerability in mpGabinet by MP Gabinet
CVE-2026-40551

8.4HIGH

Key Information:

Vendor

Binsoft

Status
Mpgabinet
Vendor
CVE Published:
28 April 2026

What is CVE-2026-40551?

The mpGabinet application exhibits a critical flaw in its client-side authentication mechanism. An attacker who gains access to any instance connected to the backend can exploit this vulnerability by manipulating the application binary. This manipulation allows the attacker to bypass the login verification process, effectively granting them the ability to authenticate as an arbitrary user without valid credentials. This issue is particularly concerning for deployments running mpGabinet version 23.12.19 and below, emphasizing the need for immediate updates and security measures.

Affected Version(s)

mpGabinet 0 <= 23.12.19

References

https://cert.pl/posts/2026/04/CVE-2026-40550/
third-party-advisory
https://www.mpgabinet.pl/
product

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert Kruczek
Kamil Szczurowski
.