Authentication Bypass in SourceCodester Simple Traffic Offense System

CVE-2026-86292 is an authentication bypass vulnerability affecting SourceCodester Simple Traffic Offense System version 1.0. The vulnerability resides within the User Creation component in the 'saveuser.php' file. An unauthenticated, remote attacker can exploit this flaw by manipulating the 'position' argument during the user creation process. Because the application fails to properly validate the user's session or authentication status before processing these requests, an attacker can illicitly create or manipulate user accounts. Publicly available exploit code for this vulnerability increases the risk of exploitation by opportunistic threat actors. Organizations utilizing this software should prioritize removing the application or ensuring it is isolated from the internet, as no patch or update has been identified.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass application-level security controls to create or modify user accounts. This grants unauthorized access to the application's administrative or management functions, potentially leading to the compromise of sensitive traffic offense data, unauthorized data exfiltration, or complete system takeover.

Recommendation

• Identify all deployments of SourceCodester Simple Traffic Offense System 1.0 within the environment.
• Restrict network access to the 'saveuser.php' endpoint to trusted internal networks only.
• Monitor web server access logs for anomalous POST requests directed at 'saveuser.php' containing the 'position' parameter.
• Given the lack of vendor patches, decommission or isolate affected systems until a security update is released.