High severity8.1NVD Advisory· Published Nov 11, 2026

CVE-2026-126815

Description

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.

Affected products

Lagarto Chivato/Lagarto Chivatollm-create
Range: <=0.4.1

Patches

Vulnerability mechanics

References

www.grayback.es/advisoriesnvd
www.grayback.es/en/advisoriesnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000