{"id":"CVE-2026-127278","title":"AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication","summary":"A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a …","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-287"],"vendor":"AIP-PUB","product":"ACPs-community","affected":["ACPs-community 2.0","ACPs-community 2.1","ACPs-community 2.2.0"],"published":"2026-11-13","updated":"2026-11-13","sourceUpdated":"2026-11-13T00:45:27.925Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-127278","references":[{"url":"https://vuldb.com/vuln/436433","label":"VDB-436433 | AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication"},{"url":"https://vuldb.com/vuln/436433/cti","label":"VDB-436433 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-127278","label":"CVE-2026-127278 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1040948","label":"Submit #1040948 | AIP-PUB ACPs-community main @ commit 8334e6b (v2.2.0) Improper Authentication"},{"url":"https://github.com/AIP-PUB/ACPs-community/issues/11"},{"url":"https://github.com/AIP-PUB/ACPs-community/"}],"tags":["cve.org"],"ingestedAt":"2026-11-13T01:19:02.061Z","slug":"CVE-2026-127278","body":"## Overview\n\nA weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason \"completed\". However, it was not possible to determine the PR or commit which could have fixed this issue.\n\n## Affected\n\n- `ACPs-community 2.0`\n- `ACPs-community 2.1`\n- `ACPs-community 2.2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}