CVE-2026-126815

The software Lagarto Chivato version 0.4.1 and earlier is vulnerable to a pre-account hijacking flaw in its web-based authentication flow (CWE-287 ). Remote unauthenticated attackers can take over arbitrary accounts by planting a password on an unregistered email address . This password becomes v...

CVE-2026-126815 Pre-account hijacking via planted password

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login...