Vvveb: Authentication bypass in password reset allows account takeover
Summary
Vvveb is a CMS with a page builder for websites, blogs and web shops. Versions before 1.0.8.7 do not properly validate the user and token GET parameters in the password reset function. According to the GitHub advisory, an attacker can supply PHP array parameters instead of strings to bypass the check, reset the password of arbitrary users and take over their accounts, including administrator accounts. No login or user interaction is required.
Affected
- Vvveb versions before 1.0.8.7 (CNA record: affected < 1.0.8.7; GitHub advisory lists 1.0.8.6 as affected)
- VulDB describes the range as up to 1.0.8.6
Fixed in
- Upgrade to Vvveb 1.0.8.7 or later (vendor fix per the CVE record and advisory)
Workaround
- No vendor workaround known.
- Restrict access to /admin and the password reset endpoints by IP address or VPN where feasible.
- Disable public self-service password reset if the business can operate without it.
Exploitation
- The GitHub advisory describes a proof of concept using crafted token[] and user[] parameters in the reset URL.
- VulDB reports that no exploit is available.
- No confirmed exploitation in the wild has been found.
Our recommendation
- Inventory all Vvveb installations and their versions.
- Upgrade all installations below 1.0.8.7 as a priority.
- Review admin accounts and recent password reset activity on internet-facing sites.
- Check web server logs for reset requests with array parameters such as token[] or user[].
- Also check the related Vvveb CVEs CVE-2026-112904 and CVE-2026-112905 and fix them with the same upgrade.
Research sources
- GitHub Security Advisory GHSA-qw5g-hcm8-9jcj github.com
- VulDB entry 429140 vuldb.com
- CVE record summary (threatint) cve.threatint.com
- OffSeq threat radar CVE-2026-110799 radar.offseq.com
- Vvveb user and login documentation docs.vvveb.com
- Vulners PT-2026-110799 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:22.
Original description (NVD)
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.