CVE-2026-64827

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://karmainsecurity.com/KIS-2026-14
https://www.teleniasoftware.com/
https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php
http://seclists.org/fulldisclosure/2026/Aug/30

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Telenia Software TVox 26.5.3 y versiones 26.x anteriores, y 24.9.21 y versiones 24.x anteriores, contienen una vulnerabilidad de omisión de autenticación en set_env.php donde la función redirectToLoginAdminIRequestHaveAccessToken() deriva el nombre de la página actual de PHP_SELF y omite la autenticación cuando el valor coincide con ’login_admin.php’. Los atacantes pueden añadir ’/login_admin.php’ a la ruta de cualquier script PHP objetivo para hacer que la verificación de autenticación pase y obtener acceso no autenticado a todos los scripts PHP bajo el directorio HTML del gestor.

Information

Published : 2026-08-03 14:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-64827

Mitre link : CVE-2026-64827

CVE.ORG link : CVE-2026-64827

JSON object : View

Products Affected

No product.

CWE

CWE-807

Reliance on Untrusted Inputs in a Security Decision

{"id": "CVE-2026-64827", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64827", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T14:27:45.340772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Telenia Software", "product": "TVox", "versions": [{"status": "affected", "version": "26.0.0", "versionType": "semver", "lessThanOrEqual": "26.5.3"}, {"status": "affected", "version": "24.0.0", "versionType": "semver", "lessThanOrEqual": "24.9.21"}], "defaultStatus": "affected"}]}], "published": "2026-08-03T14:16:27.630", "references": [{"url": "https://karmainsecurity.com/KIS-2026-14", "source": "disclosure@vulncheck.com"}, {"url": "https://www.teleniasoftware.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php", "source": "disclosure@vulncheck.com"}, {"url": "http://seclists.org/fulldisclosure/2026/Aug/30", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-807"}]}], "descriptions": [{"lang": "en", "value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory."}, {"lang": "es", "value": "Telenia Software TVox 26.5.3 y versiones 26.x anteriores, y 24.9.21 y versiones 24.x anteriores, contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en set_env.php donde la funci\u00f3n redirectToLoginAdminIRequestHaveAccessToken() deriva el nombre de la p\u00e1gina actual de PHP_SELF y omite la autenticaci\u00f3n cuando el valor coincide con \u2019login_admin.php\u2019. Los atacantes pueden a\u00f1adir \u2019/login_admin.php\u2019 a la ruta de cualquier script PHP objetivo para hacer que la verificaci\u00f3n de autenticaci\u00f3n pase y obtener acceso no autenticado a todos los scripts PHP bajo el directorio HTML del gestor."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}