8.6Hoch
CVE-2026-110972Use of Client-Side Authentication in Płatnik
Beschreibung
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002.
Schwachstellentyp (CWE):
CWE-603
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| zak ad ubezpiecze spo ecznych | p atnik | 0 – ≤ 10.02.002 | |
| Zakład Ubezpieczeń Społecznych | Płatnik | ≤ 10.02.002 |
Referenzen und Patches
- https://cert.pl/posts/2026/10/CVE-2026-110970 third-party-advisory
- https://www.zus.pl/firmy/program-platnik/o-programie-platnik product