A flaw in the Treefrog Framework, affecting versions up to 2.11.2, occurs within the std::strncmp call in src/tsessioncookiestore.cpp. The defect allows an attacker to manipulate the session cookie comparison logic, resulting in authentication bypass. The vulnerability can be exploited remotely, though the attack requires high complexity and is considered difficult. Exploit code is publicly available, so unauthorized users can potentially gain access without valid credentials.

The issue impacts the Treefrog Framework product from the treefrogframework vendor. All releases through 2.11.2 are vulnerable; versions newer than 2.11.2 are not affected to the best of available information.

The CVSS score of 6.3 indicates a moderate risk level for authentication bypass. EPSS data is unavailable, but the vulnerability is listed as not in the CISA KEV catalog. Because the exploit can be launched remotely and is publicly released, attackers could potentially compromise accounts or systems that rely on the Treefrog Framework for authentication. The high complexity and difficult exploitation make the threat moderate, yet the possibility of credential compromise warrants timely mitigation.