CVE-2026-118459
Description
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
Is your site exposed to CVE-2026-118459?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-118459? +
How do I check if I'm vulnerable to CVE-2026-118459? +
Related Vulnerabilities
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and …
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a …
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is …
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL …
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a …
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes …
