glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.
AV:N/AC:M/Au:N/C:P/I:P/A:P
This vulnerability has a 1.26% probability of being exploited in the next 30 days, ranking higher than 69% of all scored CVEs.