Vulnerability Intelligence Report
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
CVE-2026-105133
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
CISA KEV
SSVC: Active Exploitation
Automatable
Authentication Bypass
CVSS Base Score
6.9
MEDIUM
EPSS Probability:0.38%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Ahsay | AhsayCBS | 10.3.0 (affected), 10.3.1 (affected), 10.3.2 (affected), 10.3.4 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
0.383%
GitHub Advisory
Vulnerability Class
Authentication Bypass
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulDB · Researcher · Switzerland |
| Reserved | 2026-10-03T13:13:31 |
| Published | 2026-10-04T05:15:14 |
| Last Updated | 2026-10-14T19:58:23 |
Community Chatter & Buzz