CVE-2026-108969 Details
Description
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
An authentication bypass vulnerability has been identified in the itsmeravitejak Online Examination System, affecting versions prior to commit e6208e630b14657999bbfe4c9912302d2a1e2449. The issue arises in the Session Handler component, specifically within the Session::checkLogin function in include/session.php. The vulnerability allows unauthenticated users to forge remember-me cookies (cookname and cookid) and gain administrative access. This exploitation is possible because the application relies on these cookies for authentication without proper validation or integrity checks. The vulnerability can be exploited remotely.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/itsmeravitejak/Online-Examination-System/ | [email protected] | ProductVendor |
| https://github.com/itsmeravitejak/Online-Examination-System/issues/2 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-108969 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/999471 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416787 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416787/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| itsmeravitejak Online-Examination-System | e6208e630b14657999bbfe4c9912302d2a1e2449 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |