CVE-2026-122049 · Other
NO FIX YET
A flaw in the forgot-password flow of Campcodes Bitcoin Wallet System 1.0 does not restrict excessive authentication attempts. A remote attacker may be able to guess reset codes or credentials, and a public exploit has been published, though exploitation is rated difficult.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Campcodes Bitcoin Wallet System 1.0 with a publicly reachable password reset endpoint are exposed. The flaw sits in the ForgotPasswordController, so installations without that feature exposed to the internet can deprioritise it. unknown for the exact conditions the sources do not state.
Not affected if no-internet-exposure, other-version
Who cares bitcoin-wallet-system, campcodes, php
No fix yet, per the sources.
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.