CVE-2026-1203 | CRMEB up to 5.6.3 JSON Token LoginServices.php remoteRegister uid improper authentication

A vulnerability was found in CRMEB up to 5.6.3. It has been declared as critical. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON Token Handler. Executing a manipulation of the argument uid can lead to improper authentication.

This vulnerability appears as CVE-2026-1203. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.