CVE-2024-26331: ReCrystallize Server authentication bypass via a spoofable cookie
The short version: ReCrystallize Server (a web front-end for Crystal Reports) makes an authorization decision based on the value of a cookie without binding that cookie to a real session (CVE-2024-26331). An attacker can simply set the expected cookie value and reach the administrative interface without valid credentials. It's product-specific and not on CISA's KEV list, but where this server is exposed, the bypass is trivial. Steady hands — patch and fence it off.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High where exposed — a trivial unauthenticated admin bypass |
| CVSS v3.1 (NVD/CISA-ADP) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 49.32% · 98th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing (our library flagged it; we could not confirm a KEV entry) |
| Known exploited? | Not confirmed at time of writing |
| Vulnerability type | CWE-287 improper authentication → authentication bypass via a spoofable cookie |
| Requires authenticated session? | No — pre-authentication |
| Affected | ReCrystallize Server 5.10.0.0 |
| Fixed in | Unknown at time of writing — apply the vendor's current fixed release |
What you need to know
The flaw is a classic broken-authorization pattern. ReCrystallize Server decides whether a request is authorized by reading a cookie value — but it never ties that value to a server-side session. Because the check is entirely client-controlled, an attacker can set the cookie to the expected value in a browser (or from a simple script) and be treated as authenticated.
- How they find it — internet-wide scanning surfaces exposed ReCrystallize interfaces.
- How they use it — set the anticipated cookie value and request the admin pages; no password, no session hijack, no chain.
- What it leads to — access to the ReCrystallize administration interface, and the reports and configuration it fronts.
The tempering facts, stated plainly: this is a niche product with a comparatively small install base, and we could not confirm it in CISA's KEV catalog or find public evidence of in-the-wild exploitation. That lowers the likelihood relative to the mass-exploited flaws — but the impact, where the server is reachable, is a straightforward unauthenticated admin bypass.
How serious we see it
High — where the server is internet-facing.
We rate this by impact and how easy it is: an unauthenticated attacker reaching the admin interface by setting a cookie is a serious, low-effort bypass. We stop short of Critical because the practical likelihood is bounded — limited product footprint and no confirmed exploitation — not because the bug is hard to abuse. The reassuring part is that it's entirely in your hands: confirm whether you run it, patch to the vendor's fixed release, and keep it off the open internet.
Recommendations
- Patch to the vendor's fixed release. Apply the current ReCrystallize Server update that addresses the cookie-based authorization flaw; if you're on 5.10.0.0, treat it as affected.
- Get it off the open internet. Restrict ReCrystallize to trusted networks or behind an authenticating reverse proxy / VPN.
- Front it with real authentication. Where an upgrade lags, require a separate, session-bound login in front of the app.
- Review access. Check logs for unexpected admin access, and rotate any sensitive credentials or report data that may have been exposed.
- Confirm your exposure first. Verify whether any ReCrystallize Server is reachable from the internet at all.
How BreachRisk sees it
BreachRisk discovers internet-facing ReCrystallize Server interfaces from little more than your domain and fingerprints the exposed application, flagging it against this authentication-bypass flaw. Where testing is authorized, BreachRisk can safely confirm whether the cookie-based check actually admits an unauthenticated request — the difference between "this looks like ReCrystallize" and a verified exposure — as a bounded check rather than a data grab.
That's the value of an outside-in view for a niche app: the forgotten reporting server that never makes an inventory still shows up on your external footprint, ranked by whether the bypass actually holds.