---
id: "CVE-2026-127278"
page: "https://infrastack.ai/live/CVE-2026-127278"
kind: "vulnerability"
aliases: ["CVE-2026-127278"]
title: "ACPs-community registry server returns the SMS verification code in the API response, allowing account takeover"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "AIP-PUB ACPs-community", "fixed": [], "affected": "<= 2.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acps-community", "authentication", "other", "registry-server", "self-hosted"]
not_affected_if: ["not-running-acps-community", "oidc-enabled", "sms-send-replaced"]
published_at: "2026-11-13T02:18:54+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:46:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127278", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://github.com/AIP-PUB/ACPs-community/issues/11", "first_seen_at": "2026-11-13T02:46:20+00:00", "cites": ["https://github.com/AIP-PUB/ACPs-community/issues/11", "https://vuldb.com/vuln/436433"]}]
exploit_sources: []
---

# ACPs-community registry server returns the SMS verification code in the API response, allowing account takeover

Link for people: https://infrastack.ai/live/CVE-2026-127278 (this .md is for agents)

In ACPs-community registry-server (v2.2.0, commit 8334e6b), POST /api/v1/auth/verify-code returns the one-time phone verification code in the HTTP response instead of sending it by SMS, with no authentication. Anyone who knows a phone number can request the code, log in via /auth/login-phone or reset the password via /auth/reset-password. The maintainer replied on the GitHub issue that this is a reference implementation and production deployments must replace the code; no fix was released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AIP-PUB ACPs-community affected <= 2.2.0 fixed no fixed version listed

## How to check

Run the registry in local-auth mode (`[oidc] enabled = false`, the default) and POST {"phone":"<test number>"} to /api/v1/auth/verify-code on a test instance; if the JSON response contains a `code` field, it is exposed. Also check registry-server/app/account/service_auth.py: if send_verification_code just returns the generated code, and schema_auth.py VerifyCodeResponse has a `code` field, you are exposed.

## Fix

No fixed release. The maintainer (issue #11) says the code is a reference implementation and you must replace it in production: send the code only over your SMS provider, never return it in the response, and add rate limits and single-use codes bound to the phone number.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127278
- 2026-11-13T02:46:20+00:00 analyst https://github.com/AIP-PUB/ACPs-community/issues/11 — Issue #11 (GitHub) closed by maintainer as reference-code design, no commit/fix; PoC is in the issue. VulDB VDB-436433 confirms. No fix exists.

## Documents

- [advisory] [Security] /auth/verify-code returns the SMS verification code to the caller (issue #11, maintainer reply) https://github.com/AIP-PUB/ACPs-community/issues/11
- [describes] VDB-436433 AIP-PUB ACPs-community up to 2.2.0 send_verification_code https://vuldb.com/vuln/436433

## From the sources

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_