---
id: "CVE-2026-122049"
kind: "vulnerability"
aliases: ["CVE-2026-122049"]
title: "Campcodes Bitcoin Wallet System: password reset lacks limits on login attempts"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bitcoin-wallet-system", "campcodes", "other", "php"]
not_affected_if: ["no-internet-exposure", "other-version"]
published_at: "2026-11-05T00:17:22+00:00"
first_seen_at: "2026-11-05T00:31:01+00:00"
updated_at: "2026-11-05T00:32:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122049", "first_seen_at": "2026-11-05T00:31:01+00:00"}]
exploit_sources: []
---

# Campcodes Bitcoin Wallet System: password reset lacks limits on login attempts

A flaw in the forgot-password flow of Campcodes Bitcoin Wallet System 1.0 does not restrict excessive authentication attempts. A remote attacker may be able to guess reset codes or credentials, and a public exploit has been published, though exploitation is rated difficult.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the application is running Campcodes Bitcoin Wallet System 1.0 by checking the installed version
- Review core/app/Http/Controllers/Auth/ForgotPasswordController.php for the random_int usage and any attempt limiting

## Timeline

- 2026-11-05T00:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122049

## From the sources

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_