Is there a public PoC exploit available for CVE-2026-18631?

Yes, a public proof-of-concept exploit is available for CVE-2026-18631. Prioritise patching immediately. EPSS: 0.4%.

jeepay CVE-2026-18631

Q: What is the CVSS score of CVE-2026-18631?

CVE-2026-18631 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52411 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-03 VulDB

GHSA-v7r9-m72q-vvwx

Authentication Bypass Java Jeepay

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible, low-complexity bypass requiring an authenticated low-privilege account; impacts limited to low across CIA with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Aug 03, 2026 - 20:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 03, 2026 - 20:08 vuln.today

CVE Published

Aug 03, 2026 - 19:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authorization bypass in jeequan jeepay up to version 3.2.9 allows authenticated low-privilege users to circumvent access controls enforced by the PreAuthorize Handler within WebSecurityConfig, specifically targeting the SysLogController component. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling manipulation of access-control keys to reach system log data or restricted administrative functionality beyond the user's granted permissions. A public proof-of-concept exploit exists; no vendor response has been received and no patch has been confirmed, elevating remediation urgency despite the moderate CVSS score.

Technical ContextAI

jeepay is an open-source Java-based payment aggregation platform by jeequan. The affected component is the WebSecurityConfig Spring Security configuration, which governs method-level authorization via Spring's @PreAuthorize annotations. The SysLogController.java (path: jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java) handles system audit log operations. CWE-639 describes a flaw where authorization decisions rely on a user-supplied key or identifier that can be tampered with - in this context, the PreAuthorize Handler fails to properly validate that the requesting principal is authorized for the resource being accessed, allowing a lower-privileged user to substitute or manipulate identifiers to access records or endpoints restricted to higher-privileged roles. The affected CPE is cpe:2.3:a:jeequan:jeepay:*:*:*:*:*:*:*:* covering all versions through 3.2.9.

RemediationAI

No vendor-released patch has been identified at time of analysis, as the vendor did not respond to disclosure. The primary recommended action is to restrict access to the jeepay-manager administrative interface to trusted internal networks or VPN only, eliminating the network-exposed attack surface for unauthenticated and low-privileged remote exploitation. Administrators should review and harden the WebSecurityConfig Spring Security configuration to enforce strict role-based method-level authorization on all SysLogController endpoints, replacing or supplementing the flawed @PreAuthorize handler with explicit principal validation that does not rely on user-controlled keys. Additionally, enable enhanced logging and alerting on all /sysuser/ and /syslog/ endpoint access to detect unauthorized traversal attempts. Monitor the upstream jeepay GitHub repository at https://github.com/jeequan/jeepay for any commits that address authorization in SysLogController.java and apply patches as soon as available. Deploying a WAF rule to block unexpected parameter manipulation on log endpoints provides partial compensating control but is not a substitute for a code-level fix.