{"id":"CVE-2026-122049","kind":"vulnerability","aliases":["CVE-2026-122049"],"related":[],"title":"Campcodes Bitcoin Wallet System: password reset lacks limits on login attempts","description":"A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.","summary":"A flaw in the forgot-password flow of Campcodes Bitcoin Wallet System 1.0 does not restrict excessive authentication attempts. A remote attacker may be able to guess reset codes or credentials, and a public exploit has been published, though exploitation is rated difficult.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitcoin-wallet-system","campcodes","other","php"],"not_affected_if":["no-internet-exposure","other-version"],"how_to_check":"- Confirm whether the application is running Campcodes Bitcoin Wallet System 1.0 by checking the installed version\n- Review core/app/Http/Controllers/Auth/ForgotPasswordController.php for the random_int usage and any attempt limiting","fix":null,"status":"open","published_at":"2026-11-05T00:17:22+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","triaged_at":"2026-11-05T00:32:04+00:00","updated_at":"2026-11-05T00:32:04+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T00:32:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Campcodes Bitcoin Wallet System: password reset lacks limits on login attempts","impact":"medium","summary":"A flaw in the forgot-password flow of Campcodes Bitcoin Wallet System 1.0 does not restrict excessive authentication attempts. A remote attacker may be able to guess reset codes or credentials, and a public exploit has been published, though exploitation is rated difficult.","audience":"businesses","category":"other","nicknames":[],"who_cares":["campcodes","bitcoin-wallet-system","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker brute-forces accounts through unlimited password reset attempts","analyst_note":"Confirm the affected version range and whether a vendor fix exists; check the published exploit's scope against NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-122049.","how_to_check":"- Confirm whether the application is running Campcodes Bitcoin Wallet System 1.0 by checking the installed version\n- Review core/app/Http/Controllers/Auth/ForgotPasswordController.php for the random_int usage and any attempt limiting\n- unknown for further checks","plain_action":"","needs_analyst":true,"not_affected_if":["no-internet-exposure","other-version"],"who_is_affected":"Teams running Campcodes Bitcoin Wallet System 1.0 with a publicly reachable password reset endpoint are exposed. The flaw sits in the ForgotPasswordController, so installations without that feature exposed to the internet can deprioritise it. unknown for the exact conditions the sources do not state.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000739,"input_tokens":4262,"output_tokens":625,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-122049':14A,17A '-2026':13A,16A '1.0':38B,79C 'abl':50B 'affect':81C 'attack':47B,103C,107C 'attempt':11A,44B,98C 'authent':43B,97C 'bitcoin':2A,19B,35B,76C 'bitcoin-wallet-system':18B 'campcod':1A,22B,34B,75C 'caus':92C 'code':54B 'complex':109C 'core/app/http/controllers/auth/forgotpasswordcontroller.php':89C 'credenti':56B 'cve':12A,15A 'difficult':68B,121C 'excess':42B,96C 'exploit':60B,65B,100C,119C,123C 'file':88C 'flaw':26B,70C 'flow':32B 'forgot':30B 'forgot-password':29B 'found':73C 'function':83C 'guess':52B 'high':113C 'improp':93C 'indic':116C 'int':85C 'lack':7A 'limit':8A 'login':10A 'manipul':91C 'may':48B,128C 'password':5A,31B 'php':24B 'possibl':105C 'public':59B 'publish':63B,126C 'random':84C 'rate':67B,111C 'remot':46B,99C 'reset':6A,53B 'restrict':41B,94C 'system':4A,21B,37B,78C 'though':64B 'use':130C 'wallet':3A,20B,36B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Campcodes Bitcoin Wallet System 1.0 with a publicly reachable password reset endpoint are exposed. The flaw sits in the ForgotPasswordController, so installations without that feature exposed to the internet can deprioritise it. unknown for the exact conditions the sources do not state.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bitcoinwalletsystem","campcodes","low","other","php"],"campaign_type":null,"first_public_at":"2026-11-05T00:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122049","severity":null,"published_at":"2026-11-05T00:17:22+00:00","modified_at":"2026-11-05T00:17:23+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","fetched_at":"2026-11-05T00:31:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}