CVE-2025-8350CWE-306CWE-698

Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS

Critical · published February 19, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.

This issue affects BiEticaret CMS: from 2.1.13 through 19022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-698 · Execution After Redirect (EAR)
Published
2026-02-19T11:30Z
EPSS history
Timeline
  • 19 FEB 11:30Z
    Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS
    cvelistv5