CVE-2026-19974— treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19974
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| treefrogframework | treefrog-framework | 2.11.0 | cpe:2.3:a:treefrogframework:treefrog-framework:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19974
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19974
请登录查看更多情报信息。
Proof of Concept for CVE-2026-19974 (1)
Other References for CVE-2026-19974 (1)
IV. Related Vulnerabilities
Same weakness: CWE-287
- CVE-2026-19977
EFM ipTIME A3004T Session Validation httpcon_check_session_u - CVE-2026-19924
Tenda AC10 httpd R7WebsSecurityHandler improper authenticati - CVE-2026-73054
SiYuan before v3.7.4 Authentication Bypass via WebSocket - CVE-2026-15341
User Session Synchronizer <= 1.4.0 - Unauthenticated Authent - CVE-2026-15303
6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeove
V. Comments for CVE-2026-19974
No comments yet