# CVE-2026-100306: TDuck survey form password validation bypass in submission endpoints

Source: https://junglewise.ai/threats/cve-2026-100306-tduck-survey-form-through-6-0-fails-to-validate-write-passwords  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100306 · Severity: medium · CVSS 5.3 · Published 2026-09-25

TDuck is a survey and form management system used by enterprises to collect data. The product fails to validate write passwords on its submission endpoints, checking the password only in the browser rather than on the server. Attackers can bypass password protection and submit form responses without authorization by directly calling the submission API, potentially allowing unauthorized data injection and form abuse.

Technologies: [Tduckcloud Tduck-Survey-Form](https://junglewise.ai/threats/technologies/tduck-survey-form). Vendors: [Tduckcloud](https://junglewise.ai/threats/vendors/tduckcloud).

## Quick answers

**Is CVE-2026-100306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100306 being exploited in the wild.

**How severe is CVE-2026-100306?** Medium severity, with a CVSS score of 5.3, published 25 September 2026.

**Which products and versions are affected?** Tduckcloud Tduck-Survey-Form through 6.0.

**Is there a fix for CVE-2026-100306?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100306 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100306?** Check whether you run Tduckcloud Tduck-Survey-Form at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in form submission endpoints: write password validation is enforced only on the frontend, and the server-side submission API does not validate the password before accepting form data. Remote unauthenticated attackers can extract the form key from public share links and submit entries directly to the submission API, or authenticated users can use the /user/form/data/create endpoint to bypass all write restrictions (passwords, IP whitelists, quotas). The attack requires knowledge of the form key but no other credentials.

## Affected products

- TDuckCloud TDuck survey form through 6.0

## Timeline

- 2026-09-25: disclosed: CVE-2026-100306 published

## References

- [https://github.com/TDuckCloud/tduck-survey-form](https://github.com/TDuckCloud/tduck-survey-form)
- [https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py](https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py)

## Related threats

- [TDuck survey form insecure direct object reference in saveFormTheme](https://junglewise.ai/threats/cve-2026-109167-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form insecure direct object reference in submission deletion](https://junglewise.ai/threats/cve-2026-109164-tduck-survey-form-through-6-0-contains-an-insecure-direct-object)
- [TDuck survey form authentication bypass in form submission](https://junglewise.ai/threats/cve-2026-100305-tduck-survey-form-through-6-0-fails-to-enforce-form-fill-in)
- [TDuck survey form information disclosure in FormAuthUtils](https://junglewise.ai/threats/cve-2026-100304-tduck-survey-form-6-0-contains-an-information-disclosure)
- [TDuck FormThemeController authorization bypass in form themes](https://junglewise.ai/threats/cve-2026-100303-tduck-survey-form-through-6-0-lacks-authorization-checks-on)