CVE-2026-84841: tsi-coop tsi-dpdp-cms client-side enforcement of server-side security

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-05
Weakness: CWE-602

Description

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.1 is able to resolve this issue. It is recommended to upgrade the affected component.

Affected products

tsi-coop tsi-dpdp-cms: 0.1, 0.2, 0.3, 0.4, 0.5.0

References

https://github.com/mano257200/TSI-DPDP-CMS-Client-Side-Only-Authentication-Allows-Complete-Bypass-via-Direct-HTTP-Request/blob/main/README.md
https://github.com/tsi-coop/tsi-dpdp-cms/
https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/docs/security-fixes/1.md
https://github.com/tsi-coop/tsi-dpdp-cms/releases/tag/v0.5.1
https://vuldb.com/cve/CVE-2026-84841
https://vuldb.com/submit/885661
https://vuldb.com/vuln/398083
https://vuldb.com/vuln/398083/cti

Get alerted when CVE-2026-84841 or the next vulnerability affects your stack