Critical severity9.8NVD Advisory· Published Sep 16, 2026· Updated Sep 16, 2026
CVE-2026-27546
CVE-2026-27546
Description
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
1- Certvde: 15 Vulnerabilities Disclosed, Including Critical Remote Root Access FlawsVypr Intelligence · Sep 16, 2026