CVE-2026-54364 describes a session variable injection vulnerability in Gladinet CentreStack before version 17.4. The vulnerability arises from improper encoding or escaping of output in the custom session serialization format. Specifically, attackers can embed newline and tab characters into the AccountName parameter posted to the SelectProvider.aspx endpoint, enabling injection of a resellerid session variable. This injection bypasses the IsValidRSession authentication check, allowing unauthorized access to management pages without any authentication.

An unauthenticated attacker can exploit this vulnerability to inject session variables that bypass authentication controls, resulting in unauthorized access to management pages of CentreStack. This could lead to unauthorized administrative actions or disclosure of sensitive management functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time.