Vimesoft Inc. - CraftedSignal Threat Feed

Authentication Bypass Vulnerability in Vimesoft Enterprise Video Platform (CVE-2026-12691)

hello@craftedsignal.io — Fri, 17 Jul 2026 17:21:55 +0000

A high-severity authentication bypass vulnerability, identified as CVE-2026-12691, has been disclosed in Vimesoft Inc.'s Enterprise Video Platform, affecting versions from 3.11.0.0 through 3.24.9.x. This flaw is categorized as "Missing Authentication for Critical Function," meaning that specific sensitive operations within the platform can be accessed and manipulated by an unauthenticated attacker without prior login or authorization. The vulnerability carries a CVSS v3.1 base score of 7.5, indicating a significant risk, primarily impacting confidentiality. Organizations utilizing the affected versions of the Enterprise Video Platform are advised to address this vulnerability promptly to prevent unauthorized access to critical system functionalities and potentially sensitive data. This disclosure comes from the Computer Emergency Response Team of the Republic of Turkey.

Attack Chain

An attacker identifies a publicly accessible instance of the Vimesoft Enterprise Video Platform running an affected version (3.11.0.0 up to, but not including, 3.25.0).
The attacker researches or probes the platform to identify specific "critical functions" or endpoints that are intended to require authentication but are vulnerable to bypass.
The attacker crafts an HTTP request to directly target one of these critical functions, omitting any authentication credentials (e.g., session cookies, API tokens).
Due to the "Missing Authentication for Critical Function" vulnerability (CWE-306), the Vimesoft Enterprise Video Platform fails to enforce proper authentication checks.
The critical function processes the unauthenticated request as if it were legitimate, granting the attacker unauthorized execution of the function.
The attacker gains unauthorized access to sensitive information, manipulates platform settings, or performs other administrative actions without needing valid credentials.
The final objective is to achieve full unauthorized access to and control over the platform's critical features and data.

Impact

A successful exploitation of CVE-2026-12691 leads to unauthorized access to critical functions within the Vimesoft Enterprise Video Platform. This allows an unauthenticated attacker to view sensitive information (as indicated by the CVSS v3.1 Confidentiality impact of 'High') or perform unauthorized administrative actions, depending on the specific critical function exploited. The NVD report does not specify observed victims or targeted sectors, but any organization using affected versions of the platform is at risk of significant data breaches, unauthorized system configuration changes, and compromise of video content or user data, all without the attacker needing to authenticate.

Recommendation

Patch CVE-2026-12691 immediately by upgrading Vimesoft Enterprise Video Platform to version 3.25.0 or later as recommended by the vendor.
Review web server access logs for unusual unauthenticated requests to critical or administrative endpoints on Vimesoft Enterprise Video Platform instances.
Implement strong network segmentation and access controls to limit exposure of Vimesoft Enterprise Video Platform instances to untrusted networks.

CVE-2026-12693 Authorization Bypass in Vimesoft Enterprise Video Platform

hello@craftedsignal.io — Fri, 17 Jul 2026 17:19:46 +0000

A critical authorization bypass vulnerability, CVE-2026-12693, has been identified in Vimesoft Inc.'s Enterprise Video Platform. This flaw affects versions from 3.11.0.0 up to, but not including, 3.25.0. The vulnerability allows an attacker to manipulate a user-controlled key to bypass existing Access Control Lists (ACLs), thereby gaining unauthorized access to functions and data that should otherwise be restricted. With a CVSS v3.1 base score of 9.4 (Critical), the issue can be exploited remotely without authentication and requires no user interaction, making it highly attractive to adversaries. Successful exploitation can lead to severe impacts on confidentiality and integrity, as attackers can potentially view, modify, or delete sensitive information, or invoke critical system operations. Organizations using affected versions are urged to apply patches immediately to prevent exploitation.

Attack Chain

Reconnaissance: An attacker identifies an internet-facing instance of Vimesoft Inc. Enterprise Video Platform running a vulnerable version (3.11.0.0 through 3.24.x).
Vulnerability Identification: The attacker determines that the target instance is susceptible to CVE-2026-12693, an authorization bypass via a user-controlled key.
Request Crafting: The attacker crafts a malicious HTTP request that includes a manipulated "user-controlled key" parameter, header, or cookie, designed to bypass the platform's ACLs.
Initial Access: The crafted request is sent to the vulnerable platform, exploiting the flaw to gain unauthorized access to a restricted function or resource.
Functionality Access: The platform processes the request, and due to the authorization bypass, grants the attacker access to functionality or data that is not properly constrained by ACLs.
Unauthorized Actions: The attacker performs unauthorized actions, which could include accessing sensitive information, modifying system configurations, or manipulating user accounts.
Data Exfiltration/System Manipulation: Depending on the accessed functionality, the attacker may exfiltrate confidential data, inject malicious content, or otherwise compromise the integrity of the system.

Impact

Successful exploitation of CVE-2026-12693 can lead to severe consequences for organizations utilizing the Vimesoft Inc. Enterprise Video Platform. With a CVSS 3.1 score of 9.4, the vulnerability allows for high impact on confidentiality and integrity. Attackers can gain unauthorized access to sensitive video content, user data, platform configurations, and administrative functions. This could result in data breaches, intellectual property theft, disruption of video services, or complete compromise of the platform, enabling further lateral movement within an organization's network. The remote and unauthenticated nature of the exploit means a wide range of organizations using the affected product are at risk, with potential for widespread compromise if not patched promptly.

Recommendation

Patch CVE-2026-12693 immediately by upgrading Vimesoft Inc. Enterprise Video Platform to version 3.25.0 or later as advised by the vendor.
Monitor web server access logs for unusual request patterns, particularly those manipulating parameters or headers related to authentication or access control, which may indicate attempted exploitation of CVE-2026-12693.
Deploy a Web Application Firewall (WAF) to inspect and filter HTTP requests for anomalous behavior that could indicate exploitation attempts related to authorization bypasses, specifically looking for manipulation of "user-controlled keys".

CVE-2026-12692: Unverified Password Change Vulnerability in Vimesoft Enterprise Video Platform

hello@craftedsignal.io — Fri, 17 Jul 2026 17:18:34 +0000

A critical authentication bypass vulnerability, identified as CVE-2026-12692, has been discovered in Vimesoft Inc.'s Enterprise Video Platform. This flaw, present in versions ranging from 3.11.0.0 through to 3.24.9 (before 3.25.0), allows an unauthenticated attacker to change user passwords without prior verification. The vulnerability stems from an "Unverified Password Change" (CWE-620) mechanism, enabling malicious actors to reset or set new passwords for existing user accounts without requiring the current password or a secure token. Successful exploitation grants attackers complete unauthorized access to affected user accounts and the entire video platform, posing a severe risk to data integrity, confidentiality, and system availability. This vulnerability carries a CVSS v3.1 base score of 9.8, indicating its critical severity and ease of exploitation.

Attack Chain

Attacker identifies a vulnerable Vimesoft Inc. Enterprise Video Platform instance running a version between 3.11.0.0 and 3.24.9.
The attacker targets a valid user account on the platform, whose username or email address is known or can be enumerated.
The attacker crafts and sends a specific HTTP request to the platform's password reset or password change endpoint for the target user.
Due to the "Unverified Password Change" vulnerability (CVE-2026-12692), the platform processes this request and updates the target user's password without validating the user's identity or requiring the old password/a secure reset token.
The platform responds, indicating the password change was successful, or provides an error message that can be used for further enumeration.
The attacker then uses the target user's username and the newly set password to log into the Vimesoft Enterprise Video Platform.
The attacker gains full unauthorized access to the compromised user's account and all associated platform functionalities and data.

Impact

Successful exploitation of CVE-2026-12692 results in complete compromise of user accounts within the Vimesoft Enterprise Video Platform. Attackers can gain unauthorized access to sensitive video content, user data, and administrative functions, depending on the privileges of the compromised account. This can lead to data exfiltration, modification, or deletion of critical information, disruption of video services, and potential defacement of the platform. The broad range of affected versions indicates a significant potential victim base. For organizations using the vulnerable platform, the impact could include severe reputational damage, regulatory penalties for data breaches, and operational disruption.

Recommendation

Patch CVE-2026-12692 immediately by updating Vimesoft Enterprise Video Platform to version 3.25.0 or later to remediate the unverified password change vulnerability.
Monitor web server access logs for repeated or unusual password change requests, especially those originating from unexpected IP addresses or associated with administrative accounts.
Implement multi-factor authentication (MFA) for all user accounts, particularly those with elevated privileges, to add an additional layer of security against compromised credentials.
Conduct regular security audits and penetration tests on Vimesoft Enterprise Video Platform instances to identify and address similar authentication bypass vulnerabilities.