CVE-2026-94405

Executive Summary

CVE-2026-94405 is an authorization bypass vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) in the Shahjada Download Manager product, affecting all versions through 3.3.71. The flaw allows an unauthenticated, remote attacker to manipulate a user-controlled key to retrieve embedded sensitive data that should otherwise be protected by authorization controls. With a CVSS 3.1 base score of 5.3 (Medium), the primary impact is limited confidentiality loss (C:L), with no integrity or availability impact. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability has not been added to the CISA KEV catalog.

Technical Analysis

CVE-2026-94405 is classified under CWE-639, "Authorization Bypass Through User-Controlled Key." This weakness class occurs when an application uses a client-supplied identifier (such as an object ID, resource key, or reference token) to look up a protected resource but fails to verify that the requesting principal is authorized to access the object referenced by that key. The result is an insecure direct object reference (IDOR)-style access control failure, where an attacker can enumerate or substitute key values to access resources belonging to other users or otherwise restricted data.

The NVD description states the vulnerability allows an attacker to "Retrieve Embedded Sensitive Data" via the user-controlled key bypass. This indicates the confidentiality impact is limited (per the CVSS C:L subscore) — the attacker can read data that is embedded or referenced through the vulnerable key mechanism, but there is no evidence that the flaw permits modification, deletion, or code execution (I:N, A:N).

The NVD description explicitly states the issue affects "Download Manager: from n/a through 3.3.71," meaning every released version up to and including 3.3.71 is vulnerable, and no lower bound is specified. This is consistent with a plugin or module where the flawed authorization logic has existed since initial release.

The following critical details are NOT available in the provided data and must not be fabricated:

• The exact parameter name, endpoint, or function performing the key lookup.
• The specific data type described as "embedded sensitive data."
• The authentication requirement (CVSS vector specifies PR:N, meaning no privileges are required, and UI:N, meaning no user interaction is required).
• The specific code path or file location containing the flawed authorization check.

What can be stated definitively from the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N):

• AV:N (Network) — The vulnerability is exploitable remotely over the network.
• AC:L (Low) — No special conditions or race conditions are required; the attack can be performed reliably.
• PR:N (None) — No authentication is required; an unauthenticated attacker can exploit the flaw.
• UI:N (None) — No victim user interaction is required.
• S:U (Unchanged) — The exploit does not affect resources beyond the vulnerable component's security scope.
• C:L (Low) — There is limited confidentiality impact; some sensitive data is exposed.
• I:N / A:N — No integrity or availability impact.

The categorization as CWE-639 combined with "user-controlled key" strongly implies the vulnerable component accepts a client-provided key (e.g., an ID, filename, token, or reference value) and returns data based solely on that key without checking the requester's authorization. This is a class-level characterization derived directly from the CWE assignment and NVD text — no specific implementation detail is inferred beyond what is provided.

Exploitation Scenarios

Note: No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-94405 as of the latest tracked data. The attack chain described below is inferred at the vulnerability-class level (CWE-639) from the NVD description and CVSS vector. No specific function names, parameter names, or endpoint paths are fabricated.

Step 1 — Reconnaissance / Target Identification

An attacker identifies an internet-facing or network-accessible instance of Shahjada Download Manager running a version at or below 3.3.71. Because the CVSS vector indicates AV:N and PR:N, the vulnerable component is reachable over the network without authentication, making it a candidate for automated scanning and enumeration. The attacker fingerprints the product and version to confirm it falls within the affected range (≤ 3.3.71).

Step 2 — Triggering the Authorization Bypass

The attacker interacts with the vulnerable component by supplying a user-controlled key value. Per CWE-639, the application uses this client-supplied key to identify and return a resource, but does not validate that the requester is authorized to access that resource. The attacker can substitute or enumerate key values to reference data belonging to other users or otherwise restricted data. Because PR:N is specified, this step does not require prior authentication.

Step 3 — Payload / Execution Method (Class-Level)

The exploitation method is key-value manipulation (object reference substitution or enumeration), not code injection or memory corruption. The attacker modifies the user-controlled key in a request to point to a different target object. The exact request format (parameter name, HTTP method, or endpoint) is not available in the provided data and is not fabricated here. No user interaction is required (UI:N), so the attacker can perform this step autonomously.

Step 4 — Post-Exploitation Impact

On success, the attacker retrieves embedded sensitive data that is otherwise protected by the intended authorization control. The impact is limited to confidentiality (C:L per CVSS), with no integrity or availability effect. Depending on what constitutes "sensitive data" in this product — which is not specified in the source data — the exposed information could include configuration values, stored credentials, user records, or other embedded content. The attacker can likely repeat the key manipulation to enumerate multiple objects, harvesting data at scale.

Impact Assessment

CVSS 3.1 Base Score: 5.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Confidentiality (C:L — Low): The vulnerability exposes embedded sensitive data to unauthenticated remote attackers. The Low rating reflects that data exposure is limited in scope or sensitivity rather than a full compromise of all stored data.
• Integrity (I:N — None): The attacker cannot modify, delete, or corrupt data through this flaw.
• Availability (A:N — None): No denial of service or service disruption is possible via this vector.
• Scope (S:U — Unchanged): The impact is confined to the vulnerable component.

Business Impact: Organizations running Shahjada Download Manager version 3.3.71 or earlier that expose the component to untrusted networks face unauthorized disclosure of embedded sensitive data. Because exploitation requires no authentication and no user interaction (PR:N/UI:N), the flaw is trivially automatable at scale. The primary risk is data leakage — the specific severity depends entirely on what "embedded sensitive data" the product stores, which is not specified in the available intelligence. If the embedded data includes credentials, API keys, or personally identifiable information, the real-world impact could exceed the Medium base score.

Blast Radius: The vulnerable component's own security scope (S:U). No lateral movement or privilege escalation is demonstrated by the CVSS vector. However, if the exposed embedded data includes reusable credentials or key material, secondary compromise of connected systems is a conceivable downstream risk.

Affected Systems: All deployments of Shahjada Download Manager at version 3.3.71 or below. The exact lower version bound is unspecified in the NVD description ("from n/a through 3.3.71").

Detection Guidance

Because the exact request parameters, endpoint paths, and function names are not available in the source data, the detection rules below target the vulnerability class (authorization bypass via user-controlled key / IDOR-style enumeration) and the affected product generically. Analysts should tune these rules to their specific deployment and log field names.

Sigma Rule

title: Potential Authorization Bypass via User-Controlled Key in Shahjada Download Manager (CVE-2026-94405)
id: 8f3c1a72-5b4e-4d9a-9c2f-6a7e1d0b3c44
status: experimental
description: Detects patterns consistent with CWE-639 authorization bypass through enumeration or substitution of user-controlled keys against Shahjada Download Manager (<= 3.3.71). Tune key parameter names to your deployment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94405
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.639
logsource:
  category: webserver
detection:
  selection_product:
    cs-uri-stem|contains:
      - 'download-manager'
      - 'download_manager'
      - 'downloads'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_enumerate:
    cs-uri-query|contains:
      - 'id='
      - 'file='
      - 'key='
      - 'download='
      - 'item='
  filter_static:
    cs-uri-query|contains:
      - '.css'
      - '.js'
      - '.png'
      - '.jpg'
  condition: selection_product and selection_method and selection_enumerate and not filter_static
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate download traffic with sequential or enumerated identifiers
level: medium

Note: The cs-uri-query keyword list is illustrative of generic key parameters. Replace with the actual parameter used by your deployment once identified.

YARA Rule

rule CVE_2026_94405_Download_Manager_Authz_Bypass
{
    meta:
        description = "Detects Shahjada Download Manager components potentially affected by CVE-2026-94405 (CWE-639 authorization bypass)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94405"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $prod1 = "download-manager" ascii nocase
        $prod2 = "download_manager" ascii nocase
        $prod3 = "Download Manager" ascii nocase
        $ver   = /3\.3\.[0-7][0-9]/ ascii
        $cwe   = "user-controlled key" ascii nocase
        $idr   = "direct object reference" ascii nocase

    condition:
        (any of ($prod1, $prod2, $prod3)) and
        (any of ($cwe, $idr) or $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94405 Shahjada Download Manager Authorization Bypass Attempt (CWE-639)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"download"; http.uri; content:"="; pcre:"/(id|file|key|download|item)=/Ui"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,CVE-2026-94405; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94405; sid:9004405; rev:1;)

Tune the URI keyword and regex list to the actual parameter name observed in your deployment.

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and http.request.method in ("GET", "POST")
      and url.path : "*download*"
      and url.query : ("*id=*", "*file=*", "*key=*", "*download=*", "*item=*") ]
  [ network where network.protocol == "http" and http.request.method in ("GET", "POST")
      and url.path : "*download*"
      and url.query : ("*id=*", "*file=*", "*key=*", "*download=*", "*item=*")
      and http.response.status_code == 200 ]

High-volume sequential or substituted key values returned with HTTP 200 against the download component are the primary signal. Adjust url.path and url.query patterns to match your deployment.

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:access
| search uri_path="*download*" (uri_query="*id=*" OR uri_query="*file=*" OR uri_query="*key=*" OR uri_query="*download=*" OR uri_query="*item=*")
| stats count values(uri_query) as queries values(status) as statuses by src_ip, uri_path
| where count > 20
| sort - count

Detects anomalous volumes of requests to the download component containing user-controlled key parameters, consistent with enumeration or substitution attacks. Tune thresholds and parameter names to baseline.

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-94405,">
  <rule id="100905" level="8">
    <if_sid>31100</if_sid>
    <match>download</match>
    <regex>(id|file|key|download|item)=</regex>
    <description>CVE-2026-94405: Possible Shahjada Download Manager authorization bypass (CWE-639) - user-controlled key access attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_639,attack.initial_access,</group>
  </rule>

  <rule id="100906" level="10" frequency="20" timeframe="60">
    <if_matched_sid>100905</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94405: High-frequency key enumeration against Download Manager from same source (possible IDOR exploitation).</description>
    <group>cwe_639,attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor (Shahjada) has not published a fix, and no fixed version is available. There is no vendor workaround documented.

1) Immediate Mitigations

• Restrict network access: Since the flaw requires no authentication (PR:N) and is network-reachable (AV:N), the highest-impact immediate control is to block untrusted access to the affected component. Place Shahjada Download Manager behind authentication (reverse proxy, VPN, or network ACLs) and remove it from direct internet exposure.
• Virtual patching: Deploy WAF or reverse-proxy rules that enforce authorization on requests containing user-controlled key parameters, denying access to object references not owned by the requesting principal.
• Monitor and rate-limit: Apply rate limiting and log correlation to detect enumeration of key values (see Detection Guidance). Given C:L, prioritize detection of bulk enumeration over single requests.
• Minimize stored sensitive data: Where possible, remove or relocate embedded sensitive data that the component exposes, reducing the blast radius if exploitation occurs.

2) Patch / Upgrade Steps

• No patched version exists. Monitor the vendor and NVD for CVE-2026-94405 updates. When a fixed release is published, upgrade to the first version greater than 3.3.71 that includes the patch.
• Until a patch exists, treat all versions ≤ 3.3.71 as vulnerable.

3) Long-Term Hardening

• Enforce server-side authorization: Ensure the component validates that the authenticated (or anonymous) principal is authorized for every object referenced by a client-supplied key. CWE-639 remediation requires server-side ownership checks, not reliance on obscurity of the key.
• Use indirect references: Replace direct user-controlled keys with server-side session-bound mapping (indirect object references) so client keys cannot be substituted to reference arbitrary objects.
• Adopt secure SDLC and dependency review: Evaluate third-party components for CWE-639-class flaws before deployment, especially where they handle sensitive or embedded data.
• Logging and alerting: Maintain detailed access logs for the component and alert on anomalous enumeration patterns as described above.

References

1. NVD — CVE-2026-94405: https://nvd.nist.gov/vuln/detail/CVE-2026-94405
2. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
3. FIRST.org EPSS — CVE-2026-94405 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-94405
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of latest data): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor / Exploit-in-the-Wild Status: No known threat actor campaigns, public exploits, or in-the-wild exploitation evidence are associated with CVE-2026-94405 in the provided data. The CVE is not listed in CISA KEV. EPSS has not yet assigned a score. No vendor security advisory, researcher publication, or public proof-of-concept is currently available.