EUVD-2026-60026
GHSA-592m-25f6-58vw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable timing attack requiring no privileges but high complexity; session forgery yields low confidentiality and integrity impact with no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulation results in improper authentication. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
AnalysisAI
Authentication bypass in TreeFrog Framework through version 2.11.2 exploits a timing side-channel in the Session Cookie Handler, where std::strncmp's early-exit comparison behavior allows remote attackers to statistically recover valid session token values and forge authenticated sessions. Any web application compiled against the affected framework that uses default session cookie authentication is exposed. A public proof-of-concept exploit has been released, increasing targeted risk despite the high attack complexity required.
Technical ContextAI
TreeFrog Framework is a high-performance C++ web application framework. The flaw resides in src/tsessioncookiestore.cpp, which handles session cookie storage and validation. The root cause is CWE-287 (Improper Authentication): the code uses std::strncmp to compare session token values, but this standard library function terminates at the first differing byte, making comparison time proportional to the length of the matching prefix. This creates a classic timing side-channel - an attacker can probe individual bytes of a session token, detect which values produce marginally longer comparisons, and iteratively reconstruct a valid token without ever knowing the original secret. The affected CPE cpe:2.3:a:treefrogframework:treefrog-framework:*:*:*:*:*:*:*:* covers all released versions through 2.11.2. Constant-time comparison functions (such as CRYPTO_memcmp) are the accepted defense against this class of flaw.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - developers should monitor https://github.com/treefrogframework/treefrog-framework/issues/436 and the project repository for an upstream fix or tagged release. As a primary compensating control, the std::strncmp call in src/tsessioncookiestore.cpp should be replaced with a constant-time comparison function such as OpenSSL's CRYPTO_memcmp or a custom implementation that always runs for the full token length regardless of byte matching; this requires recompiling the framework and has no functional side effects on correct behavior. Secondarily, rate-limiting or throttling session validation endpoints significantly increases the number of requests and elapsed time required to statistically recover a token, raising the attack cost. Restricting application exposure to trusted networks or placing it behind a WAF with request-rate controls further reduces the window for timing measurement. Avoid regenerating session tokens on every request as a mitigation, as this does not address the comparison timing flaw itself.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today