Skip to content
Heist/ feed
High

Use of Client-Side Authentication in multiple BinSoft products

Type: advisorySource: Official CVE List1 source record

Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Announced Source revision 1
Original source ↗

CVE-2026-40551

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-40551

mpGabinet

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFaktura

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpFirma ERP

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpSekretariat

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpPOS

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpCRM

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

mpWarsztat

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "BinSoft",
    "product": "mpGabinet",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "23.12.19"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFaktura",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpFirma ERP",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "26.4.9"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpSekretariat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpPOS",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpCRM",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "25.2.4"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "BinSoft",
    "product": "mpWarsztat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "20.4.28"
      }
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-40551

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#4180 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement