mpGabinet performs client‑side authentication, which means the application verifies a user’s credentials locally rather than on the backend server. An attacker who gains the ability to modify the application binary can change the authentication logic and log in as any user without providing valid credentials. This flaw enables an attacker to gain unauthorized access, potentially exposing sensitive data and allowing further lateral movement if the backend privileges are high. The weakness is identified as CWE‑603, a flaw related to authentication (client‑side).

The vulnerability affects BinSoft’s mpGabinet product, specifically version 23.12.19 and earlier releases. Only installations of these versions with the default client‑side authentication enabled are susceptible; newer releases have presumably removed this client‑side validation.

The vulnerability carries a CVSS score of 8.4, indicating high severity. No EPSS score is available, so the current exploit probability is unknown, but the lack of a KEV listing suggests no known large‑scale exploitation at this time. The likely attack vector involves an attacker with access to any application instance that connects to the backend server; we infer that such access could be obtained either remotely through a public interface or locally by compromising a user’s machine. Once the binary is tampered with, the attacker can authenticate as an arbitrary user, leading to unauthorized system access.