CVE-2026-0589 - Vulnerability Details

- code-projects Online Product Reservation System Administration Backend improper authentication

Description

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used.

Published: 2026-01-05

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the administration backend of code‑projects Online Product Reservation System version 1.0 permits an attacker to bypass authentication by manipulating an unknown function. The vulnerability enables unauthorized users to perform administrative actions, as the check enforcing valid credentials is ineffective. The flaw is exploitable remotely and has been demonstrated publicly by an evident proof‑of‑concept.

Affected Systems

The affected product is code‑projects Online Product Reservation System 1.0, specifically the Administration Backend component that relies on the undocumented authentication function. No other versions or components are confirmed to be impacted at this time.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS value of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely exploit the weakness by sending crafted requests that trigger the unauthorized access path, ultimately gaining full administrative control.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

code-projects

Online Product Reservation System

affected

Version	Status	Constraints
`1.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:fabian:online_product_reservation_system:1.0:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Code-projects	Online Product Reservation System	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Contact the code‑projects maintainers or review the project’s repository for a patch that addresses the authentication bypass and apply it as soon as it becomes available.
If a patch is not immediately available, block or tightly restrict direct HTTP access to the administration backend using firewall rules or web server configuration (for example, with .htaccess or IP whitelisting) and enforce stronger authentication such as multi‑factor authentication.
Continuously monitor authentication logs and access patterns for suspicious activity, and consider disabling or temporarily removing the vulnerable function until a secure fix is deployed.

Generated by OpenCVE AI on April 18, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://code-projects.org/
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/auth_bypass_admin_panel.md
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/auth_bypass_admin_panel.md#poc
https://vuldb.com/?ctiid.339499
https://vuldb.com/?id.339499
https://vuldb.com/?submit.731127

History

Fri, 09 Jan 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fabian Fabian online Product Reservation System
CPEs		cpe:2.3:a:fabian:online_product_reservation_system:1.0:::::::*
Vendors & Products		Fabian Fabian online Product Reservation System

Tue, 06 Jan 2026 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Code-projects Code-projects online Product Reservation System
Vendors & Products		Code-projects Code-projects online Product Reservation System

Tue, 06 Jan 2026 00:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 05 Jan 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used.
Title		code-projects Online Product Reservation System Administration Backend improper authentication
Weaknesses		CWE-287
References		https://code-projects.org/ https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/auth_bypass_admin_panel.md https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/auth_bypass_admin_panel.md#poc https://vuldb.com/?ctiid.339499 https://vuldb.com/?id.339499 https://vuldb.com/?submit.731127
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Code-projects Online Product Reservation System

Fabian Online Product Reservation System

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-01-05T12:02:06.235Z

Updated: 2026-02-23T08:18:46.151Z

Reserved: 2026-01-04T18:06:27.713Z

Link: CVE-2026-0589

Vulnrichment

Updated: 2026-01-05T21:14:48.735Z

NVD

Status : Analyzed

Published: 2026-01-05T13:15:55.457

Modified: 2026-01-09T15:05:04.390

Link: CVE-2026-0589

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T08:30:35Z

Weaknesses

CWE-287

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object