CVE-2026-127278: AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication
A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function sendverificationcode of the file registry-server/app/account/serviceauth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.
Event History
Frequently Asked Questions
Which deployments should be considered exposed?
AIP-PUB ACPs-community installations up to version 2.2.0 are identified as impacted where the verify-code endpoint uses registry-server/app/account/service_auth.py and its send_verification_code function.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the phone argument supplied to the verify-code endpoint. No authentication or user interaction requirement is indicated in the provided severity vector.
Is public exploit information available?
Yes. The exploit has been made publicly available and could be used in attacks.
Can I confirm that a fix is included by locating the referenced upstream change?
No specific pull request or commit fixing the issue could be determined. Although the reported GitHub issue was closed as completed, the available data does not identify the corresponding code change.