CVE-2026-126371: Vvveb: SQL injection in admin auth-token save action

MEDIUM

Published November 13, 2026

CISO Take

Vvveb through 1.0.8.6 has an SQL injection flaw in its admin auth-token save action, where attacker-controlled array keys are interpolated into an INSERT column list without a whitelist or backtick escaping. Exploitation requires an authenticated admin-panel account, which limits exposure, and the CVSS score of 5.4 (medium) reflects limited confidentiality and integrity impact. No EPSS score is available, the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, so near-term exploitation likelihood appears low. Downstream dependents and the patched version are unknown, so inventory any Vvveb instances, restrict access to the admin panel, and apply the vendor fix as soon as the GitHub advisory GHSA-ffrq-8926-cpc9 identifies a patched release. Treat this as a routine patch-cycle item unless Vvveb hosts AI/ML content-management or dashboard workloads with sensitive data.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium risk. The attack is network-reachable, low complexity, needs no user interaction, and requires low privileges (an authenticated admin-panel user). Impact is limited to low confidentiality and low integrity, with no availability impact. There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data, so active exploitation is not indicated. Risk rises if admin credentials are weak, shared, or exposed, or if the admin panel is internet-facing. The AI relevance is tangential: the ml_ui category suggests a UI/CMS layer, not a core model or inference component.

How does the attack unfold?

Initial Access

The attacker obtains low-privilege admin-panel credentials for a Vvveb instance.

AML.T0012

Exploitation

The attacker submits backtick-containing array keys to the admin/auth-token save action to inject SQL into the INSERT column list.

AML.T0049

Impact

The injected SQL modifies or exposes data in the application database, giving limited confidentiality and integrity loss.

Initial Access

The attacker obtains low-privilege admin-panel credentials for a Vvveb instance.

AML.T0012

Exploitation

The attacker submits backtick-containing array keys to the admin/auth-token save action to inject SQL into the INSERT column list.

AML.T0049

Impact

The injected SQL modifies or exposes data in the application database, giving limited confidentiality and integrity loss.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Vvveb	—	—	No patch

Do you use Vvveb? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

7 steps

Identify all Vvveb deployments and confirm versions (1.0.8.6 and earlier are affected).
Apply the vendor fix referenced in GHSA-ffrq-8926-cpc9 once a patched release is available; the patched version is not stated in the data provided.
Restrict the admin panel to trusted networks or VPN and enforce strong, unique admin credentials with MFA where possible.
Review the list of admin accounts and remove unused ones.
Monitor web and database logs for requests to the admin/auth-token save action containing backticks or unusual keys, and for SQL syntax errors.
Run the database account with least privilege to limit the effect of injection.
Consider a WAF rule that blocks backtick characters in parameter names on admin endpoints.

How is it classified?

Auth BypassData LeakageFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms for responding to and recovering from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-126371?

Is CVE-2026-126371 actively exploited?

No confirmed active exploitation of CVE-2026-126371 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126371?

1. Identify all Vvveb deployments and confirm versions (1.0.8.6 and earlier are affected). 2. Apply the vendor fix referenced in GHSA-ffrq-8926-cpc9 once a patched release is available; the patched version is not stated in the data provided. 3. Restrict the admin panel to trusted networks or VPN and enforce strong, unique admin credentials with MFA where possible. 4. Review the list of admin accounts and remove unused ones. 5. Monitor web and database logs for requests to the admin/auth-token save action containing backticks or unusual keys, and for SQL syntax errors. 6. Run the database account with least privilege to limit the effect of injection. 7. Consider a WAF rule that blocks backtick characters in parameter names on admin endpoints.

What systems are affected by CVE-2026-126371?

This vulnerability affects the following AI/ML architecture patterns: Web management interfaces, Content management front-ends for ML projects.

What is the CVSS score for CVE-2026-126371?

CVE-2026-126371 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Web management interfacesContent management front-ends for ML projects

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.

Exploitation Scenario

An attacker obtains low-privilege admin-panel credentials through phishing, credential reuse, or a weak password on a Vvveb site. They send a crafted request to the admin/auth-token save action with array keys containing backticks, injecting SQL comments and extra column identifiers into the INSERT statement. This lets them write to unintended columns or manipulate auth-token records, potentially extending their access or altering stored data. The attacker may then use the altered tokens to maintain access or to pivot to other data in the application database.

Weaknesses (CWE)

CWE-89Improper Neutralization of Special Elements used in an SQL Command

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.