CVE-2026-126815

HIGH 8.1

Pre-account hijacking via planted password

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.

CWE	CWE-287
Vendor	xauendevs
Product	lagarto chivato
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for xauendevs lagarto chivato

Be the first to know when new high vulnerabilities affecting xauendevs lagarto chivato are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

XauenDevs / Lagarto Chivato

0.1.0 ≤ 0.4.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

grayback.es: https://www.grayback.es/advisories grayback.es: https://www.grayback.es/en/advisories

Credits

Daniel Hidalgo (hidalg0d)