A flaw in Pachno version 1.0.6 allows low‑privilege users to bypass authentication by manipulating the original_username cookie in the runSwitchUser() action. When an attacker sets this cookie to any value and requests a switch to user ID 1, the system grants access to session tokens or password hashes belonging to the administrator account. The weakness corresponds to CWE‑639, which represents unauthorized credential escalation.

The vulnerability affects only installations of Pachno 1.0.6 on any supported platform. Users of newer or older releases are not impacted. It arises in the specific Pacno release and does not carry over to subsequent versions unless the underlying runSwitchUser logic is unchanged.

The CVSS score of 7.1 marks it as high severity. No EPSS data is available, and the flaw has not been added to the CISA KEV catalog. An attacker only needs to be authenticated with a low‑privilege account to alter the client‑controlled original_username cookie and request a switch to the administrator user. The attack requires no additional privileges beyond the initial authenticated session, making exploitation straightforward once the cookie is manipulated.