{"id":"CVE-2026-118459","kind":"vulnerability","aliases":["CVE-2026-118459"],"related":[],"title":"Application: time-derived emergency password can be derived from public code","description":"A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.","summary":"An emergency password is generated from the current time, and the algorithm is visible in publicly available application code. An attacker who works out the password can log in without legitimate credentials.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["emergency-login","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:20+00:00","updated_at":"2026-11-09T12:27:20+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T12:27:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Application: time-derived emergency password can be derived from public code","impact":"high","summary":"An emergency password is generated from the current time, and the algorithm is visible in publicly available application code. An attacker who works out the password can log in without legitimate credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["emergency-login"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in without credentials and gains access","analyst_note":"Identify the affected product and its emergency-password feature from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118459, then find the fixed version and a check.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":4480,"output_tokens":361,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118459':15A,18A '-2026':14A,17A 'algorithm':33B 'applic':1A,39B,66C 'attack':42B 'authent':69C 'avail':38B,65C 'code':12A,40B,67C 'credenti':53B,72C 'current':29B 'cve':13A,16A 'deriv':4A,9A,57C,62C 'emerg':5A,20B,23B,58C 'emergency-login':19B 'enabl':68C 'generat':26B 'legitim':52B,71C 'log':49B 'login':21B 'password':6A,24B,47B,59C 'public':11A,37B,64C 'time':3A,30B,56C 'time-deriv':2A,55C 'visibl':35B 'without':51B,70C 'work':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emergencylogin","medium","other"],"campaign_type":null,"search_a":"'-118459':15A,18A '-2026':14A,17A 'applic':1A 'code':12A 'cve':13A,16A 'deriv':4A,9A 'emerg':5A 'password':6A 'public':11A 'time':3A 'time-deriv':2A","search_b":"'algorithm':33B 'applic':39B 'attack':42B 'avail':38B 'code':40B 'credenti':53B 'current':29B 'emerg':20B,23B 'emergency-login':19B 'generat':26B 'legitim':52B 'log':49B 'login':21B 'password':24B,47B 'public':37B 'time':30B 'visibl':35B 'without':51B 'work':44B","search_c":"'applic':66C 'authent':69C 'avail':65C 'code':67C 'credenti':72C 'deriv':57C,62C 'emerg':58C 'enabl':68C 'legitim':71C 'password':59C 'public':64C 'time':56C 'time-deriv':55C 'without':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118459","severity":null,"published_at":"2026-11-09T12:16:36+00:00","modified_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}