CVE-2011-0910: Vanillaforums Vanilla

Medium severity, CVSS 6.4. EPSS: 1% chance of exploitation in the next 30 days.

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

Affected products

• Vanillaforums Vanilla: up to and including 2.0.17.5; version 2.0.9 only; version 2.0.10 only; version 2.0.11 only; version 2.0.12 only; version 2.0.13 only; …

Published 2011-02-08. Last modified 2026-06-16.