CVE-2026-40551highCWE-603

CVE-2026-40551: high-severity vulnerability in BinSoft mpCRM

Use of Client-Side Authentication in multiple BinSoft products

Published · Updated

Follow this CVE+ Monitor mpCRM+ Monitor mpFaktura

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 0.1%
Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
BinSoft · mpCRMBinSoft · mpFakturaBinSoft · mpFirmaBinSoft · mpFirma ERPBinSoft · mpGabinetBinSoft · mpPOSBinSoft · mpSekretariatBinSoft · mpWarsztat
Related CVEs — BinSoft mpCRM

In the same product, most dangerous first.

CVE-2026-40552MEDIUMRemote Code Execution in multiple BinSoft productsEPSS 0.3%CVE-2026-40550MEDIUMPrivilege Escalation in multiple BinSoft productsEPSS 0.1%