A critical authentication flaw in the light0011 cms component allows unauthenticated attackers to hijack user identities, posing a severe risk to data integrity and platform trust.

The application utilizes an unsigned, client-controlled cookie to determine user identity within the Cookie Helper component. An unauthenticated attacker can forge this cookie to impersonate any user when performing actions such as posting comments.

The ability to impersonate legitimate users allows attackers to perform unauthorized actions, such as posting fraudulent content or misleading messages, which undermines the integrity of the platform. Given the CVSS score of 7.3, this high-severity vulnerability exposes the organization to significant reputational damage and potential loss of user trust, as account attribution can no longer be guaranteed.

Immediate Action: As no official patch is currently available, administrators should immediately disable the affected comment functionality or restrict access to the application until the vendor provides a secure fix.

Proactive Monitoring: Review application logs for anomalous comment submissions or authentication requests originating from unexpected sources, specifically monitoring for X-Requested-With: XMLHttpRequest headers associated with suspicious cookie values.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and reject requests containing suspicious or malformed username cookies, or enforce strict server-side session management that invalidates unsigned identity assertions.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

This vulnerability represents a significant security oversight that effectively bypasses account authentication mechanisms. Because the project has not yet responded to the reported issue, administrators must treat the platform as insecure for user-driven interactions. We strongly recommend immediate suspension of affected features and the implementation of robust server-side session validation to mitigate the risk of identity impersonation.