CVE-2026-118459: AIS PasswordSOS permits authentication without legitimate credentials

Published Nov 9, 2026

Updated

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

Affected Software

1 affected component

AIS PasswordSOS

Event History

Nov 9, 2026

CVE Published

via MITRE·11:47 AM

Data Sourced

via MITRE·11:47 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs access to the publicly available application code and the ability to derive the time-based emergency password. No legitimate credentials are required, although user interaction is required according to the supplied severity vector.

Who is exposed?

Deployments of AIS PasswordSOS are affected by the described authentication weakness. The provided information does not identify affected versions, configurations, or deployment conditions.

How can I determine whether my environment is affected?

Determine whether AIS PasswordSOS is deployed and whether its emergency-password mechanism is present. The supplied information does not provide version-based indicators or other detection criteria.

CVE-2026-118459: AIS PasswordSOS permits authentication without legitimate credentials

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed?

How can I determine whether my environment is affected?