| Название | AIP-PUB ACPs-community main @ commit 8334e6b (v2.2.0) Improper Authentication |
|---|
| Описание | A vulnerability was found in AIP-PUB ACPs-community up to commit 8334e6b (v2.2.0). This affects the function send_verification_code of the file registry-server/app/account/service_auth.py of the component Account Verification. The manipulation of the argument phone leads to improper authentication because the one-time verification code is returned to the caller instead of being delivered via SMS. It is possible to launch the attack remotely without authentication: POST /api/v1/auth/verify-code returns the code, which is then accepted by /api/v1/auth/login-phone and /api/v1/auth/reset-password, enabling account takeover. |
|---|
| Источник | ⚠️ https://github.com/AIP-PUB/ACPs-community/issues/11 |
|---|
| Пользователь | Evo1ution (UID 101872) |
|---|
| Представление | 18.10.2026 07:17 (26 дни назад) |
|---|
| Модерация | 12.11.2026 18:29 (26 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 436433 [AIP-PUB ACPs-community до 2.2.0 verify-code Endpoint service_auth.py send_verification_code phone слабая аутентификация] |
|---|
| Баллы | 20 |
|---|