---
id: "CVE-2026-118459"
page: "https://infrastack.ai/live/CVE-2026-118459"
kind: "vulnerability"
aliases: ["CVE-2026-118459"]
title: "Application: time-derived emergency password can be derived from public code"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["emergency-login", "other"]
not_affected_if: []
published_at: "2026-11-09T12:16:36+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118459", "first_seen_at": "2026-11-09T12:26:23+00:00"}]
exploit_sources: []
---

# Application: time-derived emergency password can be derived from public code

Link for people: https://infrastack.ai/live/CVE-2026-118459 (this .md is for agents)

An emergency password is generated from the current time, and the algorithm is visible in publicly available application code. An attacker who works out the password can log in without legitimate credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118459

## From the sources

A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_