{"id":"CVE-2026-127278","kind":"vulnerability","aliases":["CVE-2026-127278"],"related":[],"title":"ACPs-community registry server returns the SMS verification code in the API response, allowing account takeover","description":"A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason \"completed\". However, it was not possible to determine the PR or commit which could have fixed this issue.","summary":"In ACPs-community registry-server (v2.2.0, commit 8334e6b), POST /api/v1/auth/verify-code returns the one-time phone verification code in the HTTP response instead of sending it by SMS, with no authentication. Anyone who knows a phone number can request the code, log in via /auth/login-phone or reset the password via /auth/reset-password. The maintainer replied on the GitHub issue that this is a reference implementation and production deployments must replace the code; no fix was released.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AIP-PUB ACPs-community","fixed":[],"affected":"<= 2.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acps-community","authentication","other","registry-server","self-hosted"],"not_affected_if":["not-running-acps-community","oidc-enabled","sms-send-replaced"],"how_to_check":"Run the registry in local-auth mode (`[oidc] enabled = false`, the default) and POST {\"phone\":\"<test number>\"} to /api/v1/auth/verify-code on a test instance; if the JSON response contains a `code` field, it is exposed. Also check registry-server/app/account/service_auth.py: if send_verification_code just returns the generated code, and schema_auth.py VerifyCodeResponse has a `code` field, you are exposed.","fix":"No fixed release. The maintainer (issue #11) says the code is a reference implementation and you must replace it in production: send the code only over your SMS provider, never return it in the response, and add rate limits and single-use codes bound to the phone number.","status":"open","published_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:43:01+00:00","updated_at":"2026-11-13T02:46:20+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T02:43:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ACPs-community: phone verification flaw allows improper authentication remotely","impact":"medium","summary":"The ACPs-community registry server up to version 2.2.0 has a weakness in its send_verification_code function, where manipulating the phone argument leads to improper authentication. A remote attacker can exploit it, and a public exploit has been released.","audience":"businesses","category":"other","nicknames":[],"who_cares":["acps-community","registry-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses phone verification and authenticates improperly","analyst_note":"Find the fixed version or commit: the GitHub issue was closed as completed but no PR or commit was identified; check the upstream repository and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127278.","how_to_check":"- Check the installed ACPs-community version against `2.2.0`; versions up to and including `2.2.0` are listed as affected.\n- Look at `registry-server/app/account/service_auth.py` in your deployment to see whether `send_verification_code` is present and handles the `phone` argument.","plain_action":"","product_name":"AIP-PUB ACPs-community","needs_analyst":true,"not_affected_if":["not-running-acps-community"],"who_is_affected":"Teams running the AIP-PUB ACPs-community registry server up to version 2.2.0 with the phone verification endpoint exposed. The sources do not say whether a default configuration is affected or whether a specific setup is needed. Deployments that do not run this registry server are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000777,"input_tokens":4622,"output_tokens":629,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version or commit: the GitHub issue was closed as completed but no PR or commit was identified; check the upstream repository and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127278.","search":"'-127278':20A,23A '-2026':19A,22A '/api/v1/auth/verify-code':53B '/app/account/service_auth.py':149C '/auth/login-phone':88B '/auth/reset-password':94B '2.2.0':133C '8334e6':50B 'account':16A 'acp':2A,31B,43B,129C 'acps':28A 'acps-commun':1A,30B,42B,128C 'acps-community':27A 'aip':25A,126C 'aip-pub':24A,125C 'allow':15A 'anyon':75B 'api':13A 'argument':162C 'attack':170C,189C 'authent':33B,74B,168C 'avail':180C 'b':51B 'close':195C 'code':10A,61B,84B,114B,142C,155C 'commit':49B,210C 'communiti':3A,32B,44B,130C 'community':29A 'complet':199C 'compon':152C 'could':185C,212C 'cve':18A,21A 'deploy':110B 'determin':206C 'element':136C 'endpoint':156C 'execut':157C 'exploit':176C 'file':145C 'fix':116B,214C 'function':139C 'github':100B,192C 'host':40B 'howev':200C 'http':64B 'identifi':123C 'impact':135C 'implement':107B 'improp':167C 'instead':66B 'issu':101B,193C,216C 'know':77B 'launch':173C 'lead':165C 'log':85B 'made':179C 'maintain':96B 'manipul':159C 'must':111B 'number':80B 'one':57B 'one-tim':56B 'password':92B 'phone':59B,79B,163C 'possibl':204C 'post':52B 'pr':208C 'product':109B 'pub':26A,127C 'public':183C 'reason':198C 'refer':106B 'registri':4A,36B,46B,147C 'registry-serv':35B,45B,146C 'releas':118B 'remot':174C 'replac':112B 'repli':97B 'report':191C 'request':82B 'reset':90B 'respons':14A,65B 'return':6A,54B 'self':39B 'self-host':38B 'send':68B,140C 'server':5A,37B,47B,148C 'sms':8A,71B 'takeov':17A 'time':58B 'use':187C 'v2.2.0':48B 'verif':9A,60B,141C 'verifi':154C 'verify-cod':153C 'via':87B,93B 'weak':120C","nicknames":[],"mitigations":[],"who_affected":"Teams running the ACPs-community registry-server v2.2.0 (reported against main, commit 8334e6b; VulDB lists 2.0, 2.1, 2.2.0) in local phone-auth mode, which is the default and which the packaged templates do not change. If the registry is reachable by untrusted users, anyone can take over phone-registered accounts. Deployments with OIDC login enabled, or with the SMS function already replaced, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T02:46:20Z","by":"analyst","doc":"https://github.com/AIP-PUB/ACPs-community/issues/11","run_id":3808}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["acpscommunity","aippubacpscommunity"],"ptokens":["acps","aip","community","pub"],"labels":["acpscommunity","authentication","high","other","registryserver","selfhosted","vendor"],"campaign_type":null,"search_a":"'-127278':20A,23A '-2026':19A,22A 'account':16A 'acp':2A 'acps':28A 'acps-commun':1A 'acps-community':27A 'aip':25A 'aip-pub':24A 'allow':15A 'api':13A 'code':10A 'communiti':3A 'community':29A 'cve':18A,21A 'pub':26A 'registri':4A 'respons':14A 'return':6A 'server':5A 'sms':8A 'takeov':17A 'verif':9A","search_b":"'/api/v1/auth/verify-code':53B '/auth/login-phone':88B '/auth/reset-password':94B '8334e6':50B 'acp':31B,43B 'acps-commun':30B,42B 'anyon':75B 'authent':33B,74B 'b':51B 'code':61B,84B,114B 'commit':49B 'communiti':32B,44B 'deploy':110B 'fix':116B 'github':100B 'host':40B 'http':64B 'implement':107B 'instead':66B 'issu':101B 'know':77B 'log':85B 'maintain':96B 'must':111B 'number':80B 'one':57B 'one-tim':56B 'password':92B 'phone':59B,79B 'post':52B 'product':109B 'refer':106B 'registri':36B,46B 'registry-serv':35B,45B 'releas':118B 'replac':112B 'repli':97B 'request':82B 'reset':90B 'respons':65B 'return':54B 'self':39B 'self-host':38B 'send':68B 'server':37B,47B 'sms':71B 'time':58B 'v2.2.0':48B 'verif':60B 'via':87B,93B","search_c":"'/app/account/service_auth.py':149C '2.2.0':133C 'acp':129C 'acps-commun':128C 'aip':126C 'aip-pub':125C 'argument':162C 'attack':170C,189C 'authent':168C 'avail':180C 'close':195C 'code':142C,155C 'commit':210C 'communiti':130C 'complet':199C 'compon':152C 'could':185C,212C 'determin':206C 'element':136C 'endpoint':156C 'execut':157C 'exploit':176C 'file':145C 'fix':214C 'function':139C 'github':192C 'howev':200C 'identifi':123C 'impact':135C 'improp':167C 'issu':193C,216C 'launch':173C 'lead':165C 'made':179C 'manipul':159C 'phone':163C 'possibl':204C 'pr':208C 'pub':127C 'public':183C 'reason':198C 'registri':147C 'registry-serv':146C 'remot':174C 'report':191C 'send':140C 'server':148C 'use':187C 'verif':141C 'verifi':154C 'verify-cod':153C 'weak':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127278","severity":null,"published_at":"2026-11-13T02:18:54+00:00","modified_at":"2026-11-13T02:18:54+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127278:3808","url":"https://github.com/AIP-PUB/ACPs-community/issues/11","severity":null,"published_at":"2026-11-13T02:46:20+00:00","modified_at":"2026-11-13T02:46:20+00:00","first_seen_at":"2026-11-13T02:46:20+00:00","fetched_at":"2026-11-13T02:46:20+00:00","note":"Issue #11 (GitHub) closed by maintainer as reference-code design, no commit/fix; PoC is in the issue. VulDB VDB-436433 confirms. No fix exists.","cites":["https://github.com/AIP-PUB/ACPs-community/issues/11","https://vuldb.com/vuln/436433"]}],"documents":[{"id":142070,"url":"https://github.com/AIP-PUB/ACPs-community/issues/11","title":"[Security] /auth/verify-code returns the SMS verification code to the caller (issue #11, maintainer reply)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142071,"url":"https://vuldb.com/vuln/436433","title":"VDB-436433 AIP-PUB ACPs-community up to 2.2.0 send_verification_code","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}