CVE-2026-1202 is a high-severity improper authentication flaw (CVSS 7.3) in CRMEB up to version 5.6.3. The appleLogin function in LoginController.php trusts a manipulated openId argument. The record lists no fixed version and says the vendor did not respond, so disable Apple login if you do not need it.
What's affected
- Product: CRMEB, versions up to and including 5.6.3.
- Vulnerable function:
appleLoginincrmeb/app/api/controller/v1/LoginController.php. - Vulnerable argument:
openId. - Fixed version: none listed. The record says the vendor was contacted early about the disclosure and did not respond.
- Weakness class: CWE-287 (improper authentication).
- Exploitation: the record says the exploit has been released to the public. It is not in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is being exploited in the wild.
How to check if you're exposed
CRMEB is an application you host yourself, so a dependency scan will not report it. Check it directly.
- Find every CRMEB instance you run and read its version from the admin panel or the project files. Anything at 5.6.3 or below is in scope.
- Decide whether you actually use Sign in with Apple. If you do not, the function is reachable but has no business purpose.
- Review accounts that were created or signed in through Apple login. Look for logins that do not match a real customer, and for sudden access to accounts that rarely sign in.
What to do now
- If you do not use Sign in with Apple, block the Apple login route at the reverse proxy or web application firewall.
- If you do use it, review recent Apple login activity and sessions, and force a sign out for accounts you cannot match to a real customer.
- If you maintain a fork of the code, make the server verify the identity token from Apple itself and take the account identity from the verified token, not from a value the client sends.
- Watch the project for a release later than 5.6.3 and check its notes. The record does not confirm a fix.
Why it matters
Authentication code has to decide who someone is from evidence the server can check. The record says that manipulating openId in the Apple login function leads to improper authentication, but it does not publish the root cause or the exact flow. The general pattern behind this class of bug is a server that accepts an identity value from the client without checking it against the provider.
The score of 7.3 reflects easy network access with Low impact on confidentiality, integrity and availability. If your instance holds customer accounts, the real impact is access to those accounts and whatever data they expose. Public exploit information plus a silent vendor makes reducing exposure the right first move.
Quick check
Do I need to act if I do not use Apple login?
Blocking the route is a cheap precaution, because the vulnerable function is part of the application whether or not you advertise the feature.
Is a fixed CRMEB version available?
The record lists none, and says the vendor did not respond. Check the project directly.
Sources
- Gold entry and CVE record: CVE-2026-1202.
- References listed in the record, not retrievable for this review: researcher write-up and the VulDB entry.
Last reviewed: 19 October 2026.
