CVE-2026-122049 Details
Description
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
A vulnerability in Campcodes Bitcoin Wallet System version 1.0 has been identified, specifically within the random_int function of the ForgotPasswordController.php file. This flaw allows for improper management of authentication attempts, potentially leading to unauthorized access. The vulnerability can be exploited remotely, although it requires a high level of complexity.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://tracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.html | [email protected] | Content WallExploit |
| https://vuldb.com/cve/CVE-2026-122049 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1025182 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431126 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431126/cti | [email protected] | AdvisoryPermission Required |
| https://www.campcodes.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Campcodes Bitcoin Wallet System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |