CVE-2026-19906 in pkp-libinfo

Prediction

by VulDB Data Team • 08/14/2026

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.

Be aware that VulDB is the high quality source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulDB

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-19906
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-19906
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-19906/

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!