Diaple Stela: Authentication bypass via manipulable login cookie
Summary
Stela, an event and institution management software by Diaple Networking, trusts a client-side cookie named "authProcess" to complete login without validating its integrity. A remote attacker without credentials or user interaction can modify this cookie, bypass authentication and impersonate any account, including SUPER_ADMIN accounts. The attacker can then obtain a valid JWT token with administrative privileges, compromising confidentiality and integrity of the application.
Affected
- Diaple Stela versions prior to 1.60.1
- Default configuration: unaffected (per CNA record)
Fixed in
- Update to Stela version 1.60.1 or later
Workaround
- Unknown. No vendor or CERT workaround has been published.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV.
- No public exploit reported by VulDB.
Our recommendation
- Identify all Stela installations and check whether any run a version prior to 1.60.1.
- Update affected installations to version 1.60.1 or later as a priority, especially any reachable from the internet.
- Until patched, restrict network access to the Stela login and admin interfaces.
- Review access logs for unexpected administrative sessions or logins.
- Note that the vendor's download location and independent confirmation of the fix are not yet verified.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-747 www.incibe.es
- VulDB entry 420561 vuldb.com
- OpenCVE CVE-2026-101287 app.opencve.io
- Strix CVE-2026-101287 www.strix.ai
- TechConsulting summary of INCIBE notice (Spanish) techconsulting.es
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:43.
Original description (NVD)
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these values—which can be modified by the client—to complete the login process. A remote attacker, without valid credentials or interaction from other users, could manipulate the cookie to bypass authentication checks and impersonate any account, including one with SUPER_ADMIN privileges. This would allow the attacker to obtain a valid JWT token with administrative privileges and compromise the confidentiality and integrity of the application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.