Key points
- The vulnerability affects all Diaple Stela versions older than 1.60.1.
- Attackers can manipulate the authProcess cookie to bypass authentication.
- Successful exploitation grants SUPER_ADMIN privileges and valid JWT tokens.
Diaple Stela versions prior to 1.60.1 contain a critical authentication bypass vulnerability. According to the National Vulnerability Database, this flaw allows remote attackers to impersonate any account, including those with SUPER_ADMIN privileges, without needing valid credentials or interacting with other users. No confirmed fix has been stated in the source material yet, leaving teams to assess exposure.
In plain English
The application relies on a cookie named authProcess to manage login status. This cookie stores the user identifier and the authentication step status. The system fails to validate the integrity of this cookie before accepting it. Because the client can modify these values, an attacker can alter the cookie to trick the server into believing the login process is complete.
The background
The National Vulnerability Database rates CVE-2026-101287 as critical with a CVSS score of 9.3. The weakness is classified under CWE-565, which relates to unauthorized access via manipulation of trust boundaries. By manipulating the cookie, an attacker obtains a valid JSON Web Token with administrative rights. This compromises both the confidentiality and integrity of the application data.
What changes now
Security operations teams must immediately inventory their Stela installations. Any instance running a version older than 1.60.1 is vulnerable to this remote attack. Since the flaw allows full account takeover, including super administrator access, the risk is severe. Teams should monitor for unusual administrative activity while determining if an update path is available from the vendor.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Check whether your Stela instances allow unauthenticated users to set cookies. Roll out any vendor-provided update to internal systems first to test for compatibility. Back up configuration files before making changes. If no fix exists, isolate vulnerable instances from public access. Monitor logs for unexpected admin logins.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Diaple Stela
- Verify the version of Diaple Stela on all servers and flag those below 1.60.1.
- Monitor authentication logs for anomalies, such as logins with missing credential steps.
- Restrict network access to Stela interfaces if they are not required for public use.
- Wait for official vendor guidance before applying unverified patches or workarounds.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Diaple Stela are affected by this vulnerability?
All versions of Diaple Stela prior to 1.60.1 are affected by CVE-2026-101287.
Can an attacker exploit this flaw without any user interaction?
Yes, a remote attacker can exploit this vulnerability without valid credentials or interaction from other users.
What privileges can an attacker gain through this exploit?
An attacker can impersonate any account, including one with SUPER_ADMIN privileges, and obtain a valid JWT token.
