CVE-2026-1202 | CRMEB up to 5.6.3 LoginController.php appleLogin openId improper authentication

A vulnerability was found in CRMEB up to 5.6.3. It has been classified as critical. The affected element is the function appleLogin of the file crmeb/app/api/controller/v1/LoginController.php. Performing a manipulation of the argument openId results in improper authentication.

This vulnerability is reported as CVE-2026-1202. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.