CVE-2026-127278 | AIP-PUB ACPs-community up to 2.2.0 verify-code Endpoint service_auth.py send_verification_code phone improper authentication (Issue 11)

November 12, 2026 Yanac

A vulnerability labeled as critical has been found in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication.

This vulnerability is tracked as CVE-2026-127278. The attack can be launched remotely. Moreover, an exploit is present.

The reported GitHub issue was closed with the reason “completed”. However, it was not possible to determine the PR or commit which could have fixed this issue.VulDB Recent EntriesRead More