CVE-2026-25235
Last modified
CVE-2026-25235 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pear | Pearweb | < 1.33.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25235?
How severe is CVE-2026-25235?
How do I fix CVE-2026-25235?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2523A vulnerability was detected in Open5GS up to 2.7.6. The aff…7.5
- CVE-2026-25230FileRise is a self-hosted web file manager / WebDAV server. …5.4
- CVE-2026-25231FileRise is a self-hosted web file manager / WebDAV server. …7.5
- CVE-2026-25232Gogs is an open source self-hosted Git service. Versions 0.1…8.8
- CVE-2026-25233PEAR is a framework and distribution system for reusable PHP…9.1
- CVE-2026-25234PEAR is a framework and distribution system for reusable PHP…9.8
- CVE-2026-25236PEAR is a framework and distribution system for reusable PHP…9.8
- CVE-2026-25237PEAR is a framework and distribution system for reusable PHP…9.8
- CVE-2026-25238PEAR is a framework and distribution system for reusable PHP…9.8
- CVE-2026-25239PEAR is a framework and distribution system for reusable PHP…7.5
- CVE-2026-2524A flaw has been found in Open5GS 2.7.6. The impacted element…7.5
- CVE-2026-25240PEAR is a framework and distribution system for reusable PHP…9.8
Are you affected by CVE-2026-25235?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST