CVE-2026-1202 Details
Description
A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in CRMEB Mall System versions through 5.6.3, specifically in the appleLogin function of LoginController.php. The issue arises because the application fails to verify the authenticity of the Apple identity token, instead relying on the client-supplied openId without any validation. This flaw allows remote attackers to manipulate openId values, leading to unauthorized authentication. Exploitation of this vulnerability can result in the creation of fake user accounts or unauthorized access to existing accounts, bypassing Apple's authentication requirements.
To address this vulnerability, it is recommended to implement proper verification of the Apple identity token. This includes checking the token's signature using Apple's public keys, validating the issuer and audience, ensuring the token is not expired, and extracting the verified openId. Additionally, the Apple login feature can be temporarily disabled or replaced with a different authentication method.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/foeCat/CVE/blob/main/CRMEB/apple_login_auth_bypass.md | [email protected] | ExploitMitigationThird Party Advisory |
| https://vuldb.com/?ctiid.341788 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.341788 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.734711 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| crmeb crmeb | <= 5.6.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Jan 29, 2026 | Initial Analysis | [email protected] |
| Jan 20, 2026 | New CVE Received | [email protected] |