CVE-2026-126815
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.