Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-25235: pear/pearweb may let attackers fake election verification
CVE-2026-25235 · published 9 months ago
Summary
Versions of pear/pearweb before 1.33.0 use a predictable code to confirm election account requests. An attacker who guesses this code could approve those requests without permission. Upgrade to version 1.33.0 or later to resolve the issue.
What to do
- Update pear pearweb to version 1.33.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | pear | pearweb |
< 1.33.0 cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | php-pear | All versions |
Original advisory text
PEAR Has a Predictable Verification Hash in Election Account Requests
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
References
- https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25235... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25235 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-25235 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-25235 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-337Predictable Seed in Pseudo-Random Number Generator (PRNG)
Timeline
Published3 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-25235 · NVD
CVE-2026-25235 · OSV
GHSA-477r-4cmw-3cgf · GHSA
UBUNTU-CVE-2026-25235 · OSV
Track software like this
Free during beta