This vulnerability in light0011 cms involves improper authentication caused by manipulation of the Username argument in the Cookie Helper component within App/Home/Model/UserModel.class.php. The issue allows remote attackers to bypass authentication controls. The product uses a rolling release system, so no explicit affected or fixed versions are provided. Exploit code is publicly available, increasing the risk of exploitation. The vendor has been informed but has not issued a patch or mitigation guidance at this time.

Successful exploitation can lead to unauthorized authentication bypass, potentially allowing attackers to gain access without valid credentials. This could compromise the confidentiality and integrity of the affected system. However, there is no evidence of active exploitation in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, monitor official channels for updates. In the meantime, consider restricting access to the affected component or implementing additional authentication layers if possible.