CVE-2026-71809

Siam Ordering's server component (siam-server) version 1.0.0 contains a hardcoded master verification code (CWE-259) that acts as a universal authentication bypass. A remote, unauthenticated attacker who knows or recovers this embedded code can log in as any user, merchant, or administrator on an affected deployment. Successful exploitation gives full account takeover, including administrative control over the ordering platform and its merchant data. Any organization self-hosting siam-server 1.0.0 is affected. No public proof-of-concept exists and no exploitation has been observed, with EPSS estimating only a 0.2% chance of exploitation in the next 30 days.

What to do: If you run siam-server 1.0.0, assume the authentication layer is bypassable and restrict access (VPN or IP allowlisting) until a patched release is available from the project. Rotate all user, merchant, and administrator credentials and review authentication logs for logins that cannot be matched to legitimate sessions. Monitor the project's repository for a fix, since no patched version is indicated in the current data.