CVE-2026-53912

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This payload was returned unredacted through inbox index and view responses, including HTML, JSON, and CSV outputs, and could also be written unredacted into audit log entries for the inbox message. An authenticated user with sufficient privileges to access inbox entries or related audit logs could retrieve password hashes associated with pending self-registration requests. Although the exposed value is a password hash rather than a plaintext password, disclosure of password hashes may enable offline password-cracking attempts and could increase risk where users reuse passwords across systems. Cerebrate 1.37 fixes the issue by redacting sensitive password and authkey fields from inbox display/API output and recursively redacting those fields from JSON values written to audit logs, while leaving the stored registration payload intact for account creation processing. Affected component: Inbox self-registration request handling and audit logging Fixed version: Cerebrate 1.37

• CWE-200

• https://github.com/cerebrate-project/cerebrate/commit/02da6d708d610c8509a1aab3f58f53f0a91d8a04.

Published

Jun 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53907MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via t…5.4
• CVE-2026-53908MCO is vulnerable to User Enumeration through authentication…4.3
• CVE-2026-53909MCO does not correctly validate types of uploaded files. Fil…6.5
• CVE-2026-5391The LatePoint plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-53910diff3 tool from GNU diffutils is vulnerable to a heap‑based …2.1
• CVE-2026-53911Cerebrate before version 1.37 allowed the id primary key fie…6.3
• CVE-2026-53913Improper Authentication, Missing Authentication for Critical…9.8
• CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possibl…9.8
• CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution wa…8.8
• CVE-2026-53916Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-53917Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-5392Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 me…5.4