A weakness has been discovered in the light0011 cms application within the Cookie Helper component, specifically in the file App/Home/Model/UserModel.class.php. By manipulating the Username argument, an attacker can trigger improper authentication (CWE-287), allowing them to log in as any user without possessing valid credentials. This vulnerability directly compromises the integrity and confidentiality of user accounts.

The affected product is light0011 cms. Because the project follows a rolling release model and does not disclose specific versions, the exact versions impacted are unknown. The weakness applies to any deployment of the system that includes the vulnerable Cookie Helper code.

The CVSS score is 6.9. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but exploitation code has already been made public and the attack may be performed remotely. The likely attack vector involves sending a crafted Username value, possibly via a cookie or request parameter, to bypass authentication checks. Given the public availability of the exploit, the risk is that unauthenticated users can gain arbitrary access to the application.