CVE-2026-96603: Online Makeup Store Auth Bypass Vulnerability

CVE-2026-96603 Overview

CVE-2026-96603 is a missing authorization vulnerability [CWE-862] in the Abdurrab5 online-makeup-store application. The flaw resides in the confirm_logged_in and confirm_user functions within functions.php of the Admin Handler component. Attackers can manipulate the adminid argument to bypass access control checks and reach administrative functionality without proper authorization. The exploit has been publicly disclosed and can be performed remotely over the network. The vendor was contacted about the disclosure. Because the project uses a rolling release model, no fixed version identifier is available.

Critical Impact
Remote attackers can bypass authorization checks by manipulating the adminid parameter, gaining access to administrative functions of the online-makeup-store application.

Affected Products

Abdurrab5 online-makeup-store (rolling release)
Vulnerable component: Admin Handler (functions.php)
Affected functions: confirm_logged_in and confirm_user

Discovery Timeline

2026-09-23 - CVE-2026-96603 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96603

Vulnerability Analysis

The vulnerability is a broken access control issue in the Admin Handler of the online-makeup-store application. The confirm_logged_in and confirm_user functions in functions.php fail to properly validate whether the supplied adminid argument belongs to the authenticated session. An unauthenticated remote attacker can supply a crafted adminid value to satisfy the weak check and gain access to administrative operations. Because the exploit has been publicly disclosed, opportunistic actors can incorporate it into scanning tooling. Confidentiality, integrity, and availability of the affected application are all impacted at a low level, consistent with limited administrative exposure in a single application scope.

Root Cause

The root cause is missing authorization [CWE-862]. The application relies on a client-supplied adminid argument as a trust boundary rather than verifying the authenticated session identity against a server-side authorization decision. This design permits identity spoofing through parameter manipulation, allowing callers to impersonate an administrator without possessing valid credentials.

Attack Vector

The attack is remote and requires no privileges or user interaction. An attacker sends HTTP requests to endpoints protected by confirm_logged_in or confirm_user, injecting a chosen value for the adminid parameter. When the weak check passes, the application executes the requested administrative action under the attacker's control. Details of the manipulation are documented in the GitHub CVE Writeup and the VulDB Vulnerability Detail.

No verified proof-of-concept code is included here. Refer to the public writeup for technical reproduction steps.

Detection Methods for CVE-2026-96603

Indicators of Compromise

Unexpected HTTP requests containing the adminid parameter originating from unauthenticated sessions or unusual IP addresses.
Access log entries showing administrative endpoints accessed without a preceding authenticated login flow.
Repeated requests iterating through numeric adminid values, indicating enumeration attempts.

Detection Strategies

Instrument web server and application logs to record all invocations of confirm_logged_in and confirm_user along with the associated session and adminid values.
Correlate session identifiers with adminid values and alert when a mismatch occurs.
Deploy web application firewall (WAF) rules that inspect requests to administrative paths and flag adminid values submitted from sessions lacking prior authentication.

Monitoring Recommendations

Monitor for spikes in traffic to administrative PHP endpoints from single source IPs.
Track anomalous administrative actions such as user modifications, order changes, or configuration writes performed outside business hours.
Alert on any 200-status responses to admin endpoints that were not preceded by a successful authentication event.

How to Mitigate CVE-2026-96603

Immediate Actions Required

Restrict network access to the administrative interface to trusted IP ranges or a VPN until a code fix is applied.
Audit functions.php and enforce server-side session validation before honoring any adminid value.
Review application logs for prior exploitation attempts and rotate administrative credentials if suspicious access is found.

Patch Information

The vendor uses a rolling release model, and no fixed version identifier has been published for this issue. Operators should track the upstream repository for commits addressing authorization in confirm_logged_in and confirm_user, and consult the VulDB CVE-2026-96603 entry for updates.

Workarounds

Replace client-controlled adminid checks with server-side session lookups that derive the administrator identity from the authenticated session.
Add authorization middleware that validates role and session state before invoking any admin function.
Deploy WAF rules to block requests to administrative endpoints that include an adminid parameter without a valid authenticated session cookie.

bash

# Example nginx snippet restricting the admin path to a trusted network
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
}