What is GHSA-f39m-86jx-7p47?

GHSA-f39m-86jx-7p47 is a security advisory published by GitHub Security Advisories with High severity. Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web...

Which CVE IDs does GHSA-f39m-86jx-7p47 cover?

GHSA-f39m-86jx-7p47 covers the following CVE IDs: CVE-2026-126815. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f39m-86jx-7p47?

GHSA-f39m-86jx-7p47 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-f39m-86jx-7p47HighCVSS 8.1

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-126815 →

📋 Description

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-126815
https://www.grayback.es/advisories
https://www.grayback.es/en/advisories
https://github.com/advisories/GHSA-f39m-86jx-7p47