PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi

bishopfox.com | vulnerability | High | CVE-2026-27886 | #vulnerability-research | #access-control | #account-takeover | #information-disclosure | #strapi | #cve-2026-27886 | #oracle-attack | #sanitization-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.
CVE
CVE-2026-27886
CVSS
7.5
Published
Collected

Related coverage

blog · blog.sentry.security
Practical Side-Channel Attacks in Web Applications
A practical guide to web side-channel attacks (timing signals, response-size leaks, filtering oracles), illustrated by a Strapi case study ending in full bcrypt hash extraction.
blog · blog.sentry.security
Abusing Exposed Sourcemaps
Exposed Webpack sourcemaps can leak source code, secrets and hidden endpoints; one case saw a .map file reveal an undocumented endpoint enabling unauthorized password changes and account takeover.
Critical · vulnerability · bishopfox.com
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.
vulnerability · blog.quarkslab.com
Looking for vulnerabilities in Strapi (CVE-2024-34065)
Quarkslab discloses CVE-2024-34065 in Strapi: chaining an open redirect in the users-permissions auth flow with tokens leaked via URLs lets attackers bypass authentication via a crafted link.
vulnerability · hackerone.com
How an Information Disclosure Vulnerability Led to Critical Data Exposure
Information disclosure makes up 10% of HackerOne findings. The article covers how exposed keys, source code, and PII enable further attacks, plus prevention via error handling and encryption.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
Back