Stela Cookie Flaw Enables Full Admin Access Without Credentials

Diaple Stela environments running software versions prior to 1.60.1 are exposed to a severe authentication bypass vulnerability. The flaw stems from the application’s reliance on a client-side cookie named “authProcess” to manage login states. According to the National Vulnerability Database, the system fails to validate the integrity of this cookie, allowing remote actors to alter its contents without detection or prior interaction with other users.

The risk

The core issue involves the storage of sensitive session data, specifically the user identifier and the status of authentication steps, within a modifiable cookie. An attacker can manipulate these values to trick the application into believing the login process is complete. This manipulation allows the attacker to obtain a valid JSON Web Token (JWT) with high-level privileges. Consequently, the confidentiality and integrity of the application are compromised, as the attacker gains unauthorized access to protected resources.

Who is exposed

Organizations using Diaple Stela versions earlier than 1.60.1 are directly affected by this vulnerability. The impact is severe because the bypass does not require valid credentials or social engineering of other users. Attackers can target any account, including those with SUPER_ADMIN privileges. This means that any instance of the software running an outdated version is susceptible to complete takeover by a remote adversary who successfully crafts the malicious cookie payload.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 9.3 to this vulnerability, classifying it as critical. This high severity rating reflects the ease of exploitation and the significant impact on system integrity. The weakness is categorized under CWE-565, which relates to the use of a cookie without validating its integrity. Compliance frameworks that require strict authentication controls may view this as a significant deviation, given the ability to bypass identity verification entirely.

What to watch

Security operations teams should prioritize identifying all instances of Diaple Stela within their infrastructure. Verification of the current software version is the immediate next step. If the version is prior to 1.60.1, the system is considered vulnerable. Monitoring for unusual administrative activity, particularly from new or unexpected sessions, is essential while determining remediation paths.

Signals worth monitoring

Teams usually detect this type of activity by reviewing web server access logs for requests that include manipulated cookie values. Analysts should check whether authentication events show successful logins without corresponding password validation attempts in application logs. Look for sudden escalations in user privileges, such as a standard user account gaining super-admin rights. Immediate containment moves involve isolating affected systems and rotating all issued tokens to invalidate compromised sessions.

Background: Authentication bypass vulnerabilities

Authentication bypass vulnerabilities arise from logic flaws, improper session handling, and misconfigured permissions. These mistakes let attackers access data without valid credentials. Fixing them requires strict input validation, secure session management, and regular vulnerability scanning to identify weak points before exploitation.

Read the full guide: Authentication Bypass Mistakes That Leave Systems Exposed

What to do and how to stay safe: Diaple Stela

• Inventory all Diaple Stela installations and verify current version numbers against the safe threshold of 1.60.1.
• Monitor authentication logs for anomalies, such as rapid privilege escalation or logins from unfamiliar IP addresses.
• Rotate existing session tokens and JWT secrets to invalidate any potentially compromised administrative access.
• Restrict network access to Stela interfaces to trusted internal segments until a vendor patch is confirmed available.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE identifier for this Stela vulnerability?

The vulnerability is tracked as CVE-2026-101287.

Which versions of Diaple Stela are affected?

All versions prior to 1.60.1 are affected by this authentication bypass flaw.

Can an attacker gain admin rights through this bug?

Yes, an attacker can impersonate any account, including one with SUPER_ADMIN privileges.