CVE-2026-126815

{
  "etk_id": "ETK-2026-4213",
  "cve_id": "CVE-2026-126815",
  "display_id": "CVE-2026-126815",
  "ghsa_id": "GHSA-f39m-86jx-7p47",
  "euvd_id": "EUVD-2026-123800",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Pre-account hijacking in Lagarto Chivato authentication",
  "summary": "Lagarto Chivato 0.4.1 and earlier on Web has an authentication-flow flaw affecting accounts associated with previously unregistered email addresses. An unauthenticated attacker may take over such an account by establishing a password before the legitimate user first signs in through the passwordless flow. Exploitation requires the targeted email address to be unregistered when the attacker acts and later activated through an initial passwordless login.",
  "mitigation": "Disable or restrict password creation for unregistered email addresses, and require ownership verification before a password can be set or an account is activated. Review accounts created through the affected passwordless flow for unexpected passwords or ownership changes.",
  "vendor": "XauenDevs",
  "product": "Lagarto Chivato",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.1.0, <= 0.4.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Lagarto Chivato",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.686436366666667,
  "t0_at": "2026-11-11T20:10:36.118000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T20:10:36.118000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T20:10:36.118000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126815"
    }
  }
}