Critical Auth Bypass in Diaple Stela Lets Attackers Impersonate Admins
A severe flaw in Stela versions before 1.60.1 allows remote attackers to bypass login checks and gain full administrative control without valid credentials.
Key points
- CVE-2026-101287 is rated Critical with a CVSS score of 9.3.
- The vulnerability exists in Diaple Stela versions prior to 1.60.1.
- Attackers can manipulate the "authProcess" cookie to impersonate SUPER_ADMIN accounts.
The National Vulnerability Database has published CVE-2026-101287, a critical authentication bypass flaw affecting Diaple Stela. This vulnerability allows remote attackers to bypass login mechanisms and assume the identity of any user, including those with the highest administrative privileges, without possessing valid credentials or interacting with other users.
At a glance
- CVE
- CVE-2026-101287
- Product
- Diaple Stela
- CVSS
- 9.3 Critical
- Weakness
- CWE-565
- Exploited
- No known exploitation
The issue stems from how the application handles the "authProcess" cookie. According to the NVD record, Stela versions prior to 1.60.1 store the user identifier and authentication status in this cookie but fail to validate its integrity. Because the client can modify these values, an attacker can manipulate the cookie to trick the application into completing the login process for any target account.
Technical Details and Impact
The weakness is classified under CWE-565, which relates to unauthorized access through a cookie. The NVD assigns this flaw a CVSS score of 9.3, rating it as Critical. This high severity reflects the ease with which an attacker can exploit the flaw remotely and the significant impact on the confidentiality and integrity of the application.
An attacker who successfully manipulates the cookie can obtain a valid JSON Web Token (JWT) with administrative privileges. This token grants the attacker full access to the application’s features and data. The vulnerability does not require interaction from other users, making it exploitable by any remote actor who can send HTTP requests to the affected Stela instance.
Affected Versions and Scope
Only Diaple Stela versions prior to 1.60.1 are affected by this vulnerability. The source material identifies these specific versions as vulnerable due to the lack of integrity validation on the authentication cookie. Organizations running older versions of Stela are exposed to the risk of complete account takeover.
The ability to impersonate a SUPER_ADMIN account is particularly dangerous. Such accounts typically have unrestricted access to system configurations, user data, and application settings. Compromising one of these accounts allows an attacker to alter the application’s behavior and exfiltrate sensitive data, compromising the confidentiality and integrity of the application.
What should you do?
Organizations should immediately verify which version of Diaple Stela they are running. If the version is prior to 1.60.1, the system is vulnerable to this critical authentication bypass. Administrators should prioritize upgrading to version 1.60.1 or later to mitigate the risk.
What to do and how to stay safe: Diaple
- Check your current Diaple Stela version and compare it against the affected range (prior to 1.60.1).
- Review server logs for unusual authentication patterns, such as multiple failed logins followed by successful admin access.
- Restrict network access to the Stela application to trusted IP addresses until an update is applied.
- Monitor for any unexpected changes to user roles or administrative settings within the application.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-101287?
It is a critical authentication bypass vulnerability in Diaple Stela that allows attackers to manipulate cookies to gain unauthorized administrative access.
Which versions of Stela are affected?
All versions of Diaple Stela prior to 1.60.1 are affected by this vulnerability.
How serious is this vulnerability?
It is rated Critical with a CVSS score of 9.3, allowing remote attackers to impersonate any user, including SUPER_ADMIN accounts, without valid credentials.
