OpenRapid RapidCMS version 1.3.1 contains an authentication bypass flaw present in the /template/default/menu.php component. An attacker can inject a crafted SQL payload into the name cookie parameter, causing the application to construct a vulnerable SQL query without proper sanitization or parameterization. The instability aligns with CWE-89, a SQL Injection weakness, and allows an attacker to authenticate without valid credentials, exposing all application functionalities and data to compromise.

The only documented affected product is OpenRapid RapidCMS v1.3.1. No other vendors or older versions are referenced in the available data.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of < 1% signals a low exploitation probability. The flaw is not listed in the CISA KEV catalog, meaning no confirmed public exploitation yet. The likely attack vector is a remote browser cookie injection, but this is inferred from the description rather than explicitly confirmed by the data. The vulnerability can be exploited without additional privileges and does not require pre‑existing credentials, so the potential damage is significant if an attacker can manipulate the name cookie.