CVE-2026-90840: PHPGurukul Blood Donor Auth Bypass Flaw

CVE-2026-90840 Overview

CVE-2026-90840 is an improper authentication vulnerability [CWE-287] in PHPGurukul Blood Donor Management System 1.0. The flaw resides in the __construct function of /application/controllers/admin/Dashboard.php within the Admin Controllers component. Attackers can manipulate the constructor logic to bypass authentication checks and reach administrative functionality without valid credentials. The vulnerability is remotely exploitable over the network and requires no user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse against internet-facing installations.

Critical Impact
Remote unauthenticated attackers can bypass admin authentication controls in the Dashboard controller, exposing administrative functions of the Blood Donor Management System.

Affected Products

PHPGurukul Blood Donor Management System 1.0
Component: Admin Controllers (/application/controllers/admin/Dashboard.php)
Affected function: __construct

Discovery Timeline

2026-09-15 - CVE-2026-90840 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90840

Vulnerability Analysis

The vulnerability originates in the constructor of the admin Dashboard controller. In frameworks following the CodeIgniter pattern used by PHPGurukul, the __construct method is expected to enforce session validation before granting access to any admin action. When that enforcement is missing, incomplete, or logically bypassable, downstream controller methods execute without confirming an authenticated administrator session.

Because the check occurs at construction time, every action within the controller inherits the flawed authentication state. Attackers can therefore invoke administrative endpoints directly by requesting the corresponding URIs. The issue is classified under [CWE-287: Improper Authentication].

For additional technical context, see the GitHub CVE Issue Tracker and the VulDB entry for CVE-2026-90840.

Root Cause

The root cause is missing or improper session and authentication validation inside the __construct method of Dashboard.php. The constructor does not reliably verify that the requester holds a valid admin session before allowing controller methods to run. This design flaw effectively exposes protected administrative logic to unauthenticated network requests.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS. An attacker sends crafted requests to admin dashboard routes served by the vulnerable controller, and the missing authentication check permits the request to proceed. No privileges, credentials, or user interaction are required, aligning with a network-based attack path.

No verified proof-of-concept code is published in the referenced sources beyond the disclosure notes. Refer to the VulDB vulnerability record for the disclosure details.

Detection Methods for CVE-2026-90840

Indicators of Compromise

Unauthenticated HTTP requests to /application/controllers/admin/Dashboard.php or admin dashboard routes without a preceding successful login POST.
Web server access logs showing admin URI hits from external IPs with no PHPSESSID cookie or with unrecognized session identifiers.
Sudden appearance of administrative actions (record listings, exports) originating from IPs that never authenticated.
Anomalous user-agent strings scanning for PHPGurukul admin paths.

Detection Strategies

Correlate authentication events with admin controller access to identify requests reaching Dashboard.php without a valid session.
Deploy web application firewall (WAF) rules that require session cookies for admin URIs and log violations.
Monitor for repeated 200 OK responses to admin endpoints from a single source without corresponding login success events.

Monitoring Recommendations

Enable verbose logging on the web server and PHP application to capture admin route access with source IP, session ID, and referer.
Forward web and application logs to a centralized analytics or SIEM platform for correlation against authentication baselines.
Alert on any external access to /admin/ paths that bypasses the login flow.

How to Mitigate CVE-2026-90840

Immediate Actions Required

Restrict network access to the admin interface using IP allowlists, VPN, or reverse proxy authentication until a vendor fix is available.
Audit the __construct method in Dashboard.php and add explicit session validation that terminates execution when the admin session is missing.
Review recent web server logs for unauthenticated access to admin endpoints and rotate administrator credentials if compromise is suspected.
Disable or remove the Blood Donor Management System deployment if it is not required for production use.

Patch Information

At the time of publication, no official vendor patch is referenced in the NVD entry. Monitor the PHPGurukul website and the GitHub CVE Issue Tracker for updates. Apply any published fix as soon as it becomes available and validate that the constructor enforces admin session checks.

Workarounds

Place the admin directory behind HTTP Basic Authentication at the web server layer (Apache .htaccess or Nginx auth_basic) as a compensating control.
Implement a global authentication filter or middleware that intercepts all /admin/* requests and validates the session before controller instantiation.
Block direct access to Dashboard.php from untrusted networks using firewall or WAF rules.

bash

# Example Nginx configuration restricting admin routes to internal IPs
location ~ ^/application/controllers/admin/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
}