---
id: CVE-2026-127278
title: >-
  AIP-PUB ACPs-community verify-code Endpoint service_auth.py
  send_verification_code improper authentication
summary: >-
  A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The
  impacted element is the function send_verification_code of the file
  registry-server/app/account/service_auth.py of the component verify-code
  Endpoint. Executing a …
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-287
vendor: AIP-PUB
product: ACPs-community
affected:
  - ACPs-community 2.0
  - ACPs-community 2.1
  - ACPs-community 2.2.0
published: '2026-11-13'
updated: '2026-11-13'
sourceUpdated: '2026-11-13T00:45:27.925Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-127278'
references:
  - url: 'https://vuldb.com/vuln/436433'
    label: >-
      VDB-436433 | AIP-PUB ACPs-community verify-code Endpoint service_auth.py
      send_verification_code improper authentication
  - url: 'https://vuldb.com/vuln/436433/cti'
    label: 'VDB-436433 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-127278'
    label: CVE-2026-127278 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1040948'
    label: >-
      Submit #1040948 | AIP-PUB ACPs-community main @ commit 8334e6b (v2.2.0)
      Improper Authentication
  - url: 'https://github.com/AIP-PUB/ACPs-community/issues/11'
  - url: 'https://github.com/AIP-PUB/ACPs-community/'
tags:
  - cve.org
ingestedAt: '2026-11-13T01:19:02.061Z'
---

## Overview

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.

## Affected

- `ACPs-community 2.0`
- `ACPs-community 2.1`
- `ACPs-community 2.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.