PT-2026-42932 · Itzcrazykns · Vane

Yu-Bao · Published 2026-05-24 · Updated 2026-05-24 · CVE-2026-9371

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ItzCrazyKns Vane versions prior to 1.12.2

Description An issue exists in the API component within the route.ts file where unknown functionality allows for missing authentication. This flaw enables a remote attacker to bypass authentication mechanisms, although the attack complexity is high and exploitation is considered difficult.

Recommendations Update to version 1.12.2 or later. As a temporary mitigation, restrict access to the API component's route.ts file to minimize the risk of unauthorized access.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-9371

Affected Products

Vane

References · 12

• 🔥 https://github.com/ItzCrazyKns/Vane/issues/1123 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9371.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9371 · Security Note
• https://github.com/ItzCrazyKns/Vane/issues/1122 · Note
• https://t.me/CVEtracker/54767 · Telegram Post
• https://vuldb.com/submit/813209 · Note
• https://vuldb.com/vuln/365334 · Note
• https://github.com/ItzCrazyKns/Vane · Note
• https://vuldb.com/submit/813210 · Note
• https://twitter.com/CVEnew/status/2058530600555106447 · Twitter Post
• https://vuldb.com/vuln/365334/cti · Note