CVE-2026-10167: Authentication Bypass in BrinaryBrains School Management System

Technical summary

The vulnerability exists in the sign_auth_cookie function within application/controllers/Login.php of the MY_Controller component. Improper validation of the role argument during authentication cookie generation (CWE-287: Improper Authentication) allows an attacker to tamper with role assignments. The system uses rolling releases without fixed version numbers, making it difficult to precisely identify affected or patched builds. The flaw is remotely exploitable and requires no authentication or user interaction to trigger.

Business impact

Educational institutions relying on this system face direct threats to student record confidentiality, data integrity, and system availability. Unauthorized access via authentication bypass could allow attackers to view or modify student grades, personal information, and enrollment records. The combination of public exploit availability and the system's use in educational settings means attack surface is broad and motivation among threat actors is high. For administrators, this creates immediate compliance risks under FERPA and similar educational data protection regulations.

Affected systems

OUSL-GROUP-BrinaryBrains School Student Management System up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 is affected. The product uses rolling releases rather than traditional versioning, so administrators cannot rely on specific version numbers to determine exposure. Any deployment of this system at or prior to the specified commit is potentially vulnerable. Verify your deployment's commit hash against the provided reference to assess coverage.

Exploitability

Exploitability is high: the attack is remotely triggered over the network, requires no authentication to initiate, needs no user interaction, and carries no special complexity. Public exploit code has been released, dramatically lowering the barrier to weaponization. Threat actors can begin attacks immediately without reverse-engineering or developing custom tools. The CVSS 3.1 score of 7.3 (HIGH) reflects this accessible attack surface combined with meaningful impact to confidentiality, integrity, and availability.

Remediation

Contact OUSL-GROUP immediately to confirm patch status and obtain an updated build beyond the vulnerable commit hash. Given the rolling-release model, request specific build identifiers or commit hashes that remediate CVE-2026-10167. If no patch is available, implement network-level controls: restrict administrative access to the login function, enforce IP whitelisting for authentication endpoints, and monitor for suspicious role manipulation attempts in logs. Consider deploying a Web Application Firewall (WAF) to detect and block role parameter tampering patterns.

Patch guidance

Verify with the vendor whether a patched commit or release is available. Given the rolling-release approach, documentation from OUSL-GROUP should specify the minimum safe commit hash or build identifier. Update your deployment to the patched commit, then validate that the sign_auth_cookie function properly validates and sanitizes the role argument. Test authentication workflows thoroughly post-update, including multi-role user accounts, to ensure legitimate access is not disrupted.

Detection guidance

Monitor authentication logs for unusual role assignments, particularly escalations to administrative or privileged roles from untrusted sources. Inspect HTTP requests to the login endpoint for tampered or unexpected role values in cookies or POST parameters. Implement alerting for successful authentications immediately followed by privilege escalation or anomalous data access patterns. Web Application Firewall logs should flag attempts to inject or modify role values during the authentication handshake. Additionally, review login controller source code changes to confirm patched versions include explicit role validation and sanitization.

Why prioritize this

This vulnerability merits immediate attention due to four converging factors: (1) direct authentication bypass enabling unauthorized system access; (2) public exploit availability accelerating attack likelihood; (3) deployment in educational settings handling sensitive student data; and (4) vendor non-responsiveness suggesting prolonged exposure. Organizations running this system should prioritize patching or implementing compensating controls within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a remotely exploitable, unauthenticated attack with no user interaction required (AV:N/AC:L/PR:N/UI:N). Impact to confidentiality, integrity, and availability is rated as LOW individually but collectively significant for a school management context. The public availability of exploit code and the vendor's lack of response amplify real-world risk beyond the base CVSS, warranting elevated prioritization in remediation queues.

Frequently asked questions