AIP-PUB ACPS-COMMUNITY · CVE-2026-127278 · Other
NO FIX YET · SEE WHAT TO DO
In ACPs-community registry-server (v2.2.0, commit 8334e6b), POST /api/v1/auth/verify-code returns the one-time phone verification code in the HTTP response instead of sending it by SMS, with no authentication. Anyone who knows a phone number can request the code, log in via /auth/login-phone or reset the password via /auth/reset-password. The maintainer replied on the GitHub issue that this is a reference implementation and production deployments must replace the code; no fix was released.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running the ACPs-community registry-server v2.2.0 (reported against main, commit 8334e6b; VulDB lists 2.0, 2.1, 2.2.0) in local phone-auth mode, which is the default and which the packaged templates do not change. If the registry is reachable by untrusted users, anyone can take over phone-registered accounts. Deployments with OIDC login enabled, or with the SMS function already replaced, can skip it.
Not affected if not-running-acps-community, oidc-enabled, sms-send-replaced
Who cares acps-community, authentication, registry-server, self-hosted
Run the registry in local-auth mode ([oidc] enabled = false, the default) and POST {"phone":"<test number>"} to /api/v1/auth/verify-code on a test instance; if the JSON response contains a code field, it is exposed. Also check registry-server/app/account/service_auth.py: if send_verification_code just returns the generated code, and schema_auth.py VerifyCodeResponse has a code field, you are exposed.
Posts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.