CVE-2026-10167: School Management System Auth Bypass Flaw

CVE-2026-10167 Overview

CVE-2026-10167 is an improper authentication vulnerability [CWE-287] in the OUSL-GROUP-BrinaryBrains School Student Management System. The flaw resides in the sign_auth_cookie function within application/controllers/Login.php, part of the MY_Controller component. Attackers can manipulate the role argument to bypass authentication controls remotely without user interaction. The affected codebase uses a rolling release model up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6, so discrete affected and fixed version identifiers are not published. A public exploit is available, and the maintainers had not responded to the issue report at the time of disclosure.

Critical Impact
Remote attackers can manipulate the role parameter to forge authentication cookies and gain unauthorized access to student management functionality.

Affected Products

OUSL-GROUP-BrinaryBrains School Student Management System (rolling release up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6)
Component: MY_Controller
File: application/controllers/Login.php

Discovery Timeline

2026-05-31 - CVE-2026-10167 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10167

Vulnerability Analysis

The vulnerability is an authentication bypass classified under [CWE-287] Improper Authentication. The defect is located in the sign_auth_cookie function of application/controllers/Login.php, which generates authentication cookies based on user-controlled input. Because the role argument is incorporated into the signing routine without proper server-side validation, an attacker can influence the resulting cookie contents. This allows the attacker to assert an arbitrary role identity to the application. The attack is launched over the network without privileges or user interaction. A public proof of concept lowers the barrier to exploitation, and the project has not acknowledged or remediated the issue.

Root Cause

The sign_auth_cookie function trusts the role argument supplied during login flow and signs it into the session cookie without verifying that the requesting user is entitled to that role. Authentication logic conflates input acceptance with identity verification, allowing role assertions to be controlled by the client rather than enforced by the server.

Attack Vector

An unauthenticated remote attacker submits a crafted request to the login endpoint, manipulating the role argument processed by sign_auth_cookie. The application returns a signed authentication cookie that reflects the attacker-supplied role. The attacker reuses the cookie to access functionality reserved for higher-privileged accounts. No social engineering or local access is required. Technical details and the public exploit are referenced in the GitHub Issue Discussion and VulDB Vulnerability Details.

Detection Methods for CVE-2026-10167

Indicators of Compromise

Unexpected HTTP POST requests to the Login.php controller containing non-standard or unexpected role parameter values.
Authentication cookies issued to sessions whose initial login request asserted an elevated role.
Account activity where a single source IP rapidly transitions between distinct role contexts within the same session window.

Detection Strategies

Inspect web server and application logs for login requests that include a role field set to administrative or privileged values from unauthenticated sources.
Correlate cookie issuance events with subsequent access to administrative endpoints to surface privilege mismatches.
Deploy web application firewall (WAF) rules that flag or block tampering with role-bearing parameters on the login endpoint.

Monitoring Recommendations

Centralize application, web server, and authentication logs in a SIEM and alert on anomalous role transitions.
Monitor for access to admin routes from accounts that never completed a privileged onboarding workflow.
Track repeated failed and successful logins from the same source against the Login.php controller.

How to Mitigate CVE-2026-10167

Immediate Actions Required

Restrict network access to the School Student Management System to trusted networks or place it behind a VPN until a fix is available.
Audit existing sessions and invalidate authentication cookies issued during the exposure window.
Review user accounts and role assignments for evidence of unauthorized elevation.

Patch Information

No official patch is available. The project follows a rolling release model, and the maintainers had not responded to the issue report at the time of disclosure. Track the GitHub Issue Discussion for updates and apply any community-provided fixes after independent review.

Workarounds

Modify sign_auth_cookie so the role is derived from a server-side lookup against the authenticated user record rather than from client-supplied input.
Add server-side validation that rejects any login request containing an unexpected role argument.
Deploy WAF rules that strip or normalize the role parameter on requests reaching application/controllers/Login.php.

bash

# Example WAF rule (ModSecurity) to block role tampering on login
SecRule REQUEST_URI "@contains /Login.php" \
  "chain,phase:2,deny,status:403,id:1026100167,\
   msg:'CVE-2026-10167 role parameter tampering blocked'"
  SecRule ARGS:role "!@rx ^(student|guest)$" "t:none,t:lowercase"