CVE-2026-18642
HIGHCVSS 7.8/10EPSS 0.13%
Last modified
CVE-2026-18642 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TUBITAK BILGEM Software Technologies Research Institute | eta-otp-lock | < 1.0.4 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-18642?
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.
This issue affects eta-otp-lock: before 1.0.4.
How severe is CVE-2026-18642?
CVE-2026-18642 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.
How do I fix CVE-2026-18642?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18635Velociraptor's VQL has a query() plugin which allows running…7.2
- CVE-2026-18636The Velociraptor gRPC API has a VFSGetBuffer endpoint which …6.8
- CVE-2026-18638Any authenticated Velociraptor user — including one holding …6.5
- CVE-2026-18639When Velociraptor is configured to use an OIDC IdP for authe…7.3
- CVE-2026-18640The NewNotebook API does not sufficiently sanitize its param…7.1
- CVE-2026-18641A vulnerability was determined in Sangfor Operation and Main…7.3
- CVE-2026-18644A vulnerability was identified in danpros HTMLy up to 3.1.1.…5.4
- CVE-2026-18645A security flaw has been discovered in danpros HTMLy up to 3…5.4
- CVE-2026-18646A weakness has been identified in danpros HTMLy up to 3.1.1.…5.5
- CVE-2026-18647A security vulnerability has been detected in jina-ai reader…7.3
- CVE-2026-18648A vulnerability was detected in Blix Email Blue Mail Calenda…5.3
- CVE-2026-18649A flaw was found in the GStreamer gst-plugins-good package. …7.5
Are you affected by CVE-2026-18642?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST