Cyber Resilience

CVE-2026-57852

Auth Bypass

Public PoCAuth Bypass
Published
20 July 2026
Modified
21 July 2026
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0042 35th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-57852 is a medium-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the…

more

scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

CWE(s)
CWE-303

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1053.005 Scheduled Task Execution
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
attack.mitre.org →
Why these techniques?

Auth bypass in public-facing webhook directly enables T1190 exploitation; triggers operator-defined scheduled jobs/commands.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-66489Shared CWE-303
CVE-2025-14510Shared CWE-303
CVE-2026-41103Shared CWE-303
CVE-2026-33190Shared CWE-303
CVE-2025-14273Shared CWE-303
CVE-2025-23046Shared CWE-303
CVE-2026-28446Shared CWE-303
CVE-2025-57808Shared CWE-303
CVE-2025-13390Shared CWE-303
CVE-2020-37094Shared CWE-303

Affected Assets

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct implementation of authentication algorithms.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
degrades

Secure authentication control directly requires correct implementation of authentication algorithms.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect flawed authentication implementations but does not prevent them by itself.

A.8.24 Use of cryptography partial match
degrades

Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes verification steps that can catch incorrect authentication implementations.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify correct authentication algorithm use but do not guarantee correct implementation.

A.8.28 Secure coding partial match
prevents

Secure coding practices reduce the likelihood of incorrect authentication algorithm implementation.

References