CVE-2026-32969 — Pre-Auth Blind SQLi in userinfo Endpoint

CVE-2026-32969

Pre-Auth Blind SQLi in userinfo Endpoint PUBLISHED

Description (CNA)

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Affected (CNA)

Vendor / product	Versions
MB connect line / MB connect line mbCONNECT24	affected 0.0.0 through 2.19.3
MB connect line / mymbCONNECT24	affected 0.0.0 through 2.19.3
Helmholz / myREX24V2	affected 0.0.0 through 2.19.3
Helmholz / myREX24V2.virtual	affected 0.0.0 through 2.19.3

CWE

CWE-89

References

https://certvde.com/de/advisories/VDE-2026-024
https://certvde.com/de/advisories/VDE-2026-025

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.