Auth bypass in Mstfakts College-Management-System
CVE-2026-86214
A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.007 (50.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.003
Affected products
- Mstfakts College-Management-System — versions 82ab01d057d96c8893c419cd9cb6870120faaea3, a37300648b6e50d43a2f10392ad741d199635daf, c81bbedea4d9e0b860ac368aa1dbb10e55ceddce
Weakness classification (CWE)
References
- github.com/Mstfakts/College-Management-System/issues/6 (issue-tracking, exploit)
- vuldb.com/cve/CVE-2026-86214 (third-party-advisory)
- vuldb.com/submit/897250 (third-party-advisory)
- vuldb.com/vuln/399350 (technical-description, vdb-entry)
- vuldb.com/vuln/399350/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-86214?
- CVE-2026-86214 is a high-severity vulnerability in Mstfakts College-Management-System, classified under Improper Authentication. CVSS score: 7.3/10. Published 2026-09-06.
- How severe is CVE-2026-86214?
- High severity. CVSS v3 base score is 7.3 out of 10.