CVE-2026-97308: CWE-290 Authentication Bypass by Spoofing in WebFactory Login Lockdown

This vulnerability (CVE-2026-97308) in WebFactory Login Lockdown versions <= 2.17 is classified as CWE-290 (Authentication Bypass by Spoofing). It enables unauthenticated attackers to bypass authentication controls, which could allow them to gain unauthorized access to the system. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, impacting confidentiality and integrity with no availability impact.

An attacker exploiting this vulnerability can bypass authentication without valid credentials, potentially accessing restricted areas or functions. The impact is limited to partial confidentiality and integrity loss, with no impact on availability. There are no known exploits in the wild at this time.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the affected service and monitoring for suspicious activity related to authentication bypass attempts.