Authorization Bypass via User-Controlled Trusted Identifiers

Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-5799 represents a critical authorization vulnerability in Idvlabs' Ontime software where attackers can bypass access controls by manipulating user-controlled keys that are trusted by the system. This CWE-639 weakness allows threat actors to exploit the application's reliance on untrusted identifiers for authorization decisions, potentially granting unauthorized access to sensitive data or functionality. Organizations running Ontime versions through 04052026 face immediate risk, as attackers can escalate privileges or access resources without proper credentials. The vulnerability bridges both privilege escalation (TA0004) and credential access (TA0006) attack paths, making it particularly dangerous in environments where Ontime manages critical workflows or sensitive information.

Casky.ai's 283 mapped skills detect the attack patterns underlying this vulnerability by leveraging Claude's extended reasoning to correlate indicators across MITRE ATT&CK techniques. Practitioners would observe findings aligned with TA0004 (Privilege Escalation) techniques like abuse of elevation control mechanisms, where security tools flag suspicious authorization token manipulation or identifier substitution attempts. Under TA0006 (Credential Access), detections would highlight exploitation of trusted identifiers—such as API keys or session tokens—being forged or reused in unexpected contexts. Security teams would see alerts for anomalous authorization requests where user-controlled parameters bypass normal validation checks, coupled with behavioral analysis showing access patterns inconsistent with legitimate user activities, enabling rapid identification and containment of active exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5799.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-5799

Casky has 283 skills that investigate the attack patterns behind CVE-2026-5799. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn