Authorization Bypass via User-Controlled Trusted Identifiers

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-5730 represents a critical authorization bypass vulnerability in Idvlabs' Ontime software (versions through 04052026) that exploits user-controlled keys to bypass identity verification mechanisms. This CWE-639 weakness allows attackers to manipulate trusted identifiers—authentication tokens, session keys, or role indicators—that the application incorrectly trusts without proper server-side validation. Organizations running affected Ontime instances face direct risk of unauthorized access to sensitive functionality, data exfiltration, and privilege escalation. The vulnerability is particularly dangerous because it doesn't require exploiting code flaws; instead, it abuses the application's fundamental trust in client-supplied authentication data.

Casky.ai's 283 mapped skills detect the attack patterns underlying this vulnerability by analyzing behaviors aligned with MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) tactics. Using Claude AI with extended reasoning, Casky identifies suspicious patterns such as: unexpected privilege elevation without corresponding access control checks, manipulation of authentication tokens in request headers or cookies, inconsistencies between claimed and validated user identities, and lateral movement using hijacked trusted identifiers. Practitioners would observe findings highlighting user-controlled parameters flowing directly into authorization decisions, missing server-side re-validation of claimed roles or permissions, and audit logs showing access grants that bypass normal authentication workflows—enabling security teams to pinpoint the exact code paths and configuration weaknesses before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5730.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-5730

Casky has 283 skills that investigate the attack patterns behind CVE-2026-5730. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn