Description
Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows.
Affected products
creacast: creabox manager
References2
- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-… ExploitThird Party Advisory
- www.creacast.com/ Product
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 42 · as of 8 November 2026
- CWE
- CWE-287CWE-798
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.