CVE-2026-1363
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Jan 23, 2026
CISA due date
—
The record
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-76945 The affected Ebyte device relies on client-managed authentication tokens without… CWE-603
- CVE-2026-71187 The Ebyte device relies on client side authentication logic that can be reproduced by… CWE-603
- CVE-2026-42098 Sparx Enterprise Architect software has a security feature that limits user's actions to… CWE-603
- CVE-2026-8830 A flaw was found in Keycloak. CWE-603
- CVE-2026-40551 mpGabinet performs client-side authentication. CWE-603
- CVE-2025-30042 The CGM CLININET system provides smart card authentication; however, authentication is… CWE-603
- CVE-2025-64119 A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This… CWE-603
- CVE-2025-12868 New Site Server developed by CyberTutor has a Use of Client-Side Authentication… CWE-603