# CVE-2026-112205: WidzialniCMS bruteforce protection bypass in login

Source: https://junglewise.ai/threats/cve-2026-112205-widzialnicms-is-vulnerable-to-bruteforce-protection-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-112205 · Severity: info · Published 2026-11-09

WidzialniCMS is a content management system used to build accessible websites. An unauthenticated attacker can bypass the login attempt rate-limiting by omitting cookies, allowing unlimited password guessing attacks and potential account takeover.

Technologies: [Fundacja Widzialni WidzialniCMS](https://junglewise.ai/threats/technologies/widzialnicms). Vendors: [Fundacja Widzialni](https://junglewise.ai/threats/vendors/fundacja-widzialni).

## Quick answers

**Is CVE-2026-112205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112205 being exploited in the wild.

**How severe is CVE-2026-112205?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Fundacja Widzialni WidzialniCMS before 2.5.

**Is there a fix for CVE-2026-112205?** Yes: fixed in 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112205 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112205?** Check whether you run Fundacja Widzialni WidzialniCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5

## Technical details

The vulnerability is an improper restriction of excessive authentication attempts (CWE-307). The login lockout mechanism relies on cookie-based tracking of failed attempts (login_count and login_timeout cookies); an attacker can bypass this by simply omitting these cookies from requests, resetting the lockout counter. This is a network-based attack requiring no authentication or user interaction.

## Affected products

- Fundacja Widzialni WidzialniCMS before 2.5

## Timeline

- 2026-11-09: disclosed

## References

- [https://cert.pl/posts/2026/11/CVE-2026-110468](https://cert.pl/posts/2026/11/CVE-2026-110468)
- [https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175](https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175)

## Related threats

- [WidzialniCMS reflected XSS in /index.php](https://junglewise.ai/threats/cve-2026-112204-widzialnicms-is-vulnerable-to-reflected-xss-in-the-index-php)
- [WidzialniCMS unrestricted file upload in /panel/upload.php](https://junglewise.ai/threats/cve-2026-110469-widzialnicms-is-vulnerable-to-unrestricted-file-upload-in-the)
- [WidzialniCMS unrestricted file upload in save_photo.php](https://junglewise.ai/threats/cve-2026-110468-widzialnicms-is-vulnerable-to-unrestricted-file-upload-in-the)