Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi

bishopfox.com | vulnerability | High | CVE-2026-27886 | #vulnerability-research | #access-control | #account-takeover | #information-disclosure | #strapi | #cve-2026-27886 | #oracle-attack | #sanitization-bypass

Summary

CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.
CVSS
7.5
Published
Collected

original ↗

Related coverage

  1. Google Bug Hunters (bughunters.google.com)
  2. CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation (aretiq.ai)
  3. CVE-2026-48827 — Apache MINA SSHD sshd-git Path Traversal Info Disclosure (aretiq.ai)
  4. Practical Side-Channel Attacks in Web Applications (blog.sentry.security)
  5. A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit (bishopfox.com)
  6. Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557 (bishopfox.com)

back