Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()
Not on CISA's list of exploited flaws, and not in the news we track.
0.56%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126377. Nothing runs until you send it.
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.
You are affected if
The fix