What is the CVSS score of CVE-2026-2347?

CVE-2026-2347 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of E-Commerce Website are affected by CVE-2026-2347?

Akilli Commerce E-Commerce Website versions before 4.5.001 contain a critical authorization bypass vulnerability (CVSS 9.8) that allows unauthenticated remote attackers to hijack user sessions and…. A patch is available.

How to fix or mitigate CVE-2026-2347?

Within 24 hours: Inventory all Akilli Commerce deployments and verify current version; immediately isolate any internet-facing instance of version 4.5.000 or earlier from production if feasible, or implement emergency network access restrictions. Within 7 days: Contact Akilli Commerce vendor directly to confirm patch timeline; deploy any intermediate security updates or vendor-provided mitigations; implement enhanced session monitoring and logging. Within 30 days: Upgrade all instances to Akilli Commerce 4.5.001 or later immediately upon release; conduct forensic audit of session logs and user activity for signs of compromise.

E-Commerce Website CVE-2026-2347

EUVD-2026-30264 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-14 TR-CERT

GHSA-q88p-27gr-q4g5

Authentication Bypass E Commerce Website

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 11:01 EUVD

Analysis Generated

May 14, 2026 - 10:15 vuln.today

CVE Published

May 14, 2026 - 09:25 nvd

CRITICAL 9.8

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.

This issue affects E-Commerce Website: before 4.5.001.

AnalysisAI

Authorization bypass in Akilli Commerce E-Commerce Website before 4.5.001 allows remote unauthenticated attackers to hijack user sessions through user-controlled key manipulation. The vulnerability enables complete system compromise with high impact to confidentiality, integrity, and availability. Turkish national CERT (TR-CERT) published an advisory, indicating regional significance. No public exploit code or CISA KEV listing identified at time of analysis, but the CVSS 9.8 Critical rating and network-accessible, unauthenticated attack vector suggest this is highly exploitable if the platform is internet-facing.

Technical ContextAI

This vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application incorrectly uses user-supplied input as a direct key to authorize access to resources or sessions. In e-commerce platforms, this typically manifests when session identifiers, user IDs, or authorization tokens in cookies, URL parameters, or POST data are not properly validated server-side. The application trusts client-controlled values to determine session ownership, allowing attackers to substitute their own identifiers with those of legitimate users. The affected product is Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website (CPE: cpe:2.3:a:akilli_commerce_software_technologies_ltd._co.:e-commerce_website), a Turkish e-commerce platform. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is a network-accessible vulnerability with low complexity requiring no privileges or user interaction, making it trivially exploitable once the vulnerable parameter is identified.

RemediationAI

Upgrade to Akilli Commerce E-Commerce Website version 4.5.001 or later, as confirmed by TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0222). This is the primary and only confirmed fix. If immediate patching is not feasible, implement the following compensating controls with their trade-offs: Deploy a web application firewall (WAF) with custom rules to block suspicious session token patterns in requests (requires signature development and ongoing tuning; may cause false positives for legitimate session management). Implement additional server-side session validation tied to client IP address and User-Agent strings (reduces session hijacking success but breaks legitimate use cases where users change networks or browsers mid-session). Enable strict server-side session binding to prevent cross-session access attempts (most effective mitigation but requires code changes and testing). Restrict administrative and customer account access via VPN or IP allowlisting where operationally feasible (significantly limits exposure but impacts user experience and sales operations). Monitor authentication logs for anomalous session activity such as rapid session switches or geographically inconsistent access patterns (detection only, not prevention; requires SIEM integration and analyst review).