CVE-2026-31271 Auth bypass in n/a
Unauthenticated attackers can create super administrator accounts via the user insertion endpoint, leading to complete system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31271?
CVE-2026-31271 is a critical authentication bypass vulnerability in n/a, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.
Weakness: CWE-288
Which versions are affected by CVE-2026-31271?
How do I fix CVE-2026-31271?
No fix has been published for CVE-2026-31271 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-31271 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31271 exists.
Sources
Also known as GHSA-q8pq-mm5c-rq9h.