PatchSiren cyber security CVE debrief
CVE-2026-10167 OUSL-GROUP-BrinaryBrains CVE debrief
A medium-severity improper authentication vulnerability (CWE-287) affects OUSL-GROUP-BrinaryBrains School Student Management System up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. The vulnerability resides in the `sign_auth_cookie` function within `application/controllers/Login.php` of the `MY_Controller` component. An attacker can remotely manipulate the `role` argument to bypass authentication controls. The exploit has been publicly disclosed. The project uses rolling releases, so specific version numbers for affected and patched releases are unavailable. The vendor was notified via an issue report prior to publication but had not responded as of the CVE publication date.
- Vendor
- OUSL-GROUP-BrinaryBrains
- Product
- School Student Management System
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-31
- Original CVE updated
- 2026-05-31
- Advisory published
- 2026-05-31
- Advisory updated
- 2026-05-31
Who should care
Organizations using OUSL-GROUP-BrinaryBrains School Student Management System; security teams monitoring PHP-based student information systems; developers responsible for authentication and authorization in CodeIgniter-based applications
Technical summary
The `sign_auth_cookie` function in `application/controllers/Login.php` fails to properly validate or enforce the `role` parameter, allowing remote attackers to manipulate authentication cookies and gain unauthorized access. The vulnerability is exploitable without authentication and has a publicly available exploit.
Defensive priority
medium
Recommended defensive actions
- Review and restrict role parameter handling in the sign_auth_cookie function within application/controllers/Login.php
- Implement server-side validation and authorization checks independent of client-supplied role values
- Apply principle of least privilege to authentication cookies and session management
- Monitor for unauthorized authentication attempts or privilege escalation in application logs
- Consider implementing additional authentication factors or session binding to reduce impact of cookie manipulation
- If using this product, apply any future updates from the vendor promptly given the rolling release model
Evidence notes
The vulnerability was reported through a GitHub issue and documented by Vuldb. The CVSS 4.0 vector indicates network attack vector with low complexity, no privileges required, and low impacts to confidentiality, integrity, and availability. The exploit is confirmed to exist per the CVSS exploit metric (E:P).
Official resources
Public exploit available; vendor notified but unresponsive