Session Authentication Bypass via Cookie Parameter Manipulation

CVE-2026-108969 represents a critical authentication flaw in the itsmeravitejak Online-Examination-System where the Session::checkLogin function in include/session.php performs incorrect comparison logic on cookie parameters (cookname/cookid). This vulnerability allows remote attackers to bypass session validation without requiring valid credentials, potentially granting unauthorized access to examination systems and sensitive student or administrator data. Organizations deploying this component—particularly educational institutions using this open-source examination platform—face immediate risk of account takeover and data exfiltration. The public disclosure and rolling-release nature of this software means vulnerable instances may remain unpatched across multiple deployments.

While this CVE lacks explicit MITRE ATT&CK mapping, Casky.ai would detect attack patterns associated with T1110 (Brute Force), T1528 (Steal Application Access Token), and T1078 (Valid Accounts) through behavioral analysis of session manipulation attempts. Practitioners using Casky would observe anomalies in authentication flows: malformed or unexpected cookie values bypassing validation checks, multiple failed login attempts suddenly converting to successful sessions without credential submission, and session tokens persisting across credential changes. Claude's extended reasoning capability would correlate these signals—recognizing that incorrect comparison logic in authentication handlers typically indicates logical flaws rather than cryptographic weaknesses—and surface recommendations for code review of comparison operators, implementation of secure session management libraries, and monitoring for suspicious cookie manipulation in access logs.