What is the CVSS score of CVE-2026-31271?

CVE-2026-31271 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-31271?

CVE-2026-31271 is a critical unauthenticated account creation vulnerability in megagao production_ssm v1.0 that allows attackers to create super administrator accounts without credentials, granting…

How to fix or mitigate CVE-2026-31271?

Within 24 hours: Identify all systems running megagao production_ssm v1.0 and isolate them from production networks or immediately decommission if not business-critical. Within 7 days: Contact megagao for patch status and timeline; implement network-based access controls restricting /user/insert endpoint to authorized IP ranges only as interim mitigation. Within 30 days: Migrate to a patched version of megagao production_ssm once vendor releases a security update, or replace with an alternative product if no patch is provided within 60 days.

Java CVE-2026-31271

EUVD-2026-19765 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-07 mitre

GHSA-q8pq-mm5c-rq9h

Authentication Bypass Java N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19765

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks authentication checks, allowing unauthenticated attackers to create super administrator accounts by directly accessing the /user/insert endpoint. This leads to complete system compromise.

AnalysisAI

Unauthenticated account creation bypass in megagao production_ssm v1.0 allows remote attackers to create super administrator accounts via direct API access to /user/insert endpoint. The UserController.java insert() method processes account creation requests without authentication enforcement (CVSS vector PR:N confirms unauthenticated access). Successful exploitation grants full administrative control, enabling attackers to compromise confidentiality, integrity, and availability of the entire application. No public exploit identified at time of analysis.

Technical ContextAI

CWE-288 authentication bypass stems from missing authorization checks in the insert() method of UserController.java. The Java-based application exposes the /user/insert REST endpoint without requiring session validation or credential verification before processing user creation requests, allowing privilege escalation to super administrator roles through direct API invocation.

RemediationAI

No vendor-released patch identified at time of analysis. Project maintainers have not published a fixed version per available advisories. Immediate mitigation requires implementing server-side authentication controls on the /user/insert endpoint to validate session tokens and enforce role-based access restrictions before processing account creation requests. Organizations should disable or firewall access to /user/insert until authentication enforcement is deployed. Verify all user management endpoints require authenticated sessions with appropriate authorization levels. Review commit history at https://github.com/clockw1se0v0/Vul/blob/main/production_ssm/Unauthorized.md for technical exploitation details. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-31271