CVE-2026-67249

The Apache Answer software is vulnerable to an account takeover via a verification code purpose confusion flaw in versions through 2.0.2 . Because the system fails to properly enforce the purpose of issued email-based verification codes, a code intended for one workflow might be accepted by anoth...

CVE-2026-67249 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...