CVE-2026-64827 is an authentication bypass vulnerability in Telenia Software TVox affecting versions 26.5.3 and prior 26.x, and 24.9.21 and prior 24.x. The vulnerability arises because the redirectToLoginAdminIRequestHaveAccessToken() function in set_env.php uses the PHP_SELF variable to identify the current page. When PHP_SELF contains '/login_admin.php', the function bypasses authentication checks. Attackers can exploit this by appending '/login_admin.php' to the URL path of any PHP script under the manager HTML directory, thereby bypassing authentication and gaining unauthorized access.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain access to all PHP scripts under the manager HTML directory in affected TVox versions. This can lead to unauthorized administrative access and potential full compromise of the affected system. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the manager HTML directory via network controls or web server configuration to prevent unauthenticated access. Monitor for any vendor updates or patches addressing this vulnerability.