CVE-2026-14622
Published: 04 July 2026
Summary
CVE-2026-14622 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-41661
Vulnerability details
A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely.…
more
The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session content review can reveal authentication bypasses or failures in session establishment.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.
Requires adaptive authentication under specific conditions, directly strengthening authentication mechanisms against improper or insufficient authentication.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Requires unique identification and authentication of organizational users, directly preventing improper authentication.
Enforces unique device identification and authentication before any connection is established, directly mitigating improper authentication weaknesses.
Directly requires implementation of compliant authentication mechanisms to cryptographic modules, preventing improper authentication.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (3 rules)
- V-248827 OL 8 must not have the rsh-server package installed. via CWE-287
- V-248585 OL 8 must require reauthentication when using the "sudo" command. via CWE-306
- V-248827 OL 8 must not have the rsh-server package installed. via CWE-306
RHEL 7 (5 rules)
- V-204424 The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. via CWE-287
- V-204425 The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password. via CWE-287
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. via CWE-306
RHEL 8 (3 rules)
- V-230492 RHEL 8 must not have the rsh-server package installed. via CWE-287
- V-230492 RHEL 8 must not have the rsh-server package installed. via CWE-306
- V-237643 RHEL 8 must require re-authentication when using the "sudo" command. via CWE-306
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-287
Ubuntu 24.04 (2 rules)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-287
- V-270714 Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. via CWE-287