CVE-2026-126815: Pre-account hijacking via planted password

Published Nov 11, 2026

Updated

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.

Event History

Nov 11, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments of Lagarto Chivato on the Web at version 0.4.1 or earlier are affected. The exposure concerns accounts associated with email addresses that are not yet registered and later use passwordless login for the first time.

What must an attacker do to exploit it?

The attacker must plant a password for an unregistered email address before the legitimate owner first completes a passwordless login. No authentication is required for the attacker, but victim interaction is required because the victim must perform that first passwordless login.

What is the likely impact if exploitation succeeds?

An attacker can take over arbitrary affected accounts. The reported impact includes high confidentiality and integrity impact, with no availability impact indicated.

CVE-2026-126815: Pre-account hijacking via planted password

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What is the likely impact if exploitation succeeds?