CVE-2026-38930: OpenRapid RapidCMS Auth Bypass Flaw

CVE-2026-38930 Overview

CVE-2026-38930 is an authentication bypass vulnerability in OpenRapid RapidCMS v1.3.1. The flaw resides in the /template/default/menu.php component. Attackers exploit the issue by injecting a crafted SQL payload into the name cookie parameter. Successful exploitation allows an unauthenticated attacker to bypass authentication and access protected functionality of the content management system.

The vulnerability combines SQL injection with broken authentication logic. Because the name cookie is processed without proper sanitization or parameterization, attackers can manipulate the underlying SQL query to authenticate as an arbitrary user.

Critical Impact

Remote, unauthenticated attackers can bypass login controls in RapidCMS v1.3.1 by submitting a malicious name cookie value, gaining access to restricted CMS functionality.

Affected Products

• OpenRapid RapidCMS v1.3.1
• /template/default/menu.php component
• Deployments exposing the affected cookie-based authentication flow

Discovery Timeline

• 2026-05-27 - CVE-2026-38930 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-38930

Vulnerability Analysis

The vulnerability is an authentication bypass driven by SQL injection [CWE-89, CWE-287] in the menu.php template handler. RapidCMS reads the name cookie value and concatenates it directly into a SQL statement used to validate the requesting user. Because the input is not sanitized, parameterized, or type-checked, an attacker controls the structure of the resulting query.

By injecting SQL syntax such as boolean tautologies into the name cookie, an attacker can force the authentication query to return a valid record without supplying legitimate credentials. The CMS then treats the request as authenticated and serves protected resources.

Exploitation requires no privileges and no user interaction. The attacker only needs network access to the affected web application and the ability to set the name cookie on a request to /template/default/menu.php.

Root Cause

The root cause is unsafe handling of untrusted input from HTTP cookies. The application uses the name cookie value as part of a dynamically constructed SQL query without input validation or prepared statements. Cookie data is treated as trusted authentication state rather than attacker-controlled input.

Attack Vector

The attack vector is remote and network-based. An attacker issues an HTTP request to the vulnerable endpoint with a crafted Cookie: name=<payload> header. The payload contains SQL metacharacters that alter the WHERE clause of the authentication query. Once the query returns a row, the application establishes an authenticated session for the attacker.

The vulnerability mechanism is described in prose only because no verified proof-of-concept code is referenced here. Technical details and request examples are documented in the GitHub CVE-2026-38930 Analysis.

Detection Methods for CVE-2026-38930

Indicators of Compromise

• HTTP requests to /template/default/menu.php containing SQL metacharacters (', --, OR, UNION) in the name cookie
• Authenticated sessions established without a preceding successful POST to the login endpoint
• Web server access logs showing unusually long or URL-encoded Cookie: name= values targeting menu.php

Detection Strategies

• Inspect web server and application logs for cookie values containing SQL syntax targeting the affected component
• Deploy web application firewall (WAF) rules that flag SQL injection patterns in cookie headers
• Correlate access to administrative CMS pages with the absence of valid authentication events for the same session

Monitoring Recommendations

• Enable verbose logging of cookie headers on the RapidCMS web tier
• Forward web and database logs to a centralized analytics platform for query anomaly review
• Alert on database errors or unexpected query syntax originating from menu.php

How to Mitigate CVE-2026-38930

Immediate Actions Required

• Restrict public access to RapidCMS v1.3.1 instances until a vendor fix is available
• Place a WAF in front of the application with rules blocking SQL injection patterns in cookie headers
• Audit existing sessions and force re-authentication for all CMS users

Patch Information

No vendor patch is referenced in the available CVE data. Administrators should monitor the OpenRapid Security Resource and RapidCMS Security Information pages for an official update. Until a fix is published, treat all RapidCMS v1.3.1 deployments as exposed.

Workarounds

• Block or strip cookie values containing SQL metacharacters at the reverse proxy or WAF layer
• Modify /template/default/menu.php to reject non-alphanumeric values in the name cookie and replace string concatenation with parameterized queries
• Limit network access to the CMS to trusted IP ranges or place it behind a VPN until remediation is confirmed

# Example ModSecurity rule to block SQLi patterns in the 'name' cookie
SecRule REQUEST_COOKIES:name "@rx (?i)(\bunion\b|\bselect\b|--|';|\bor\b\s+\d+=\d+)" \
    "id:1003890,phase:1,deny,status:403,log,\
    msg:'CVE-2026-38930: SQLi attempt in name cookie'"