CVE-2026-64827 is an authentication bypass vulnerability in Telenia Software TVox affecting versions 26.5.3 and prior in the 26.x series, and 24.9.21 and prior in the 24.x series. The vulnerability exists in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function relies on the PHP_SELF server variable to identify the current page. If the value matches 'login_admin.php', the function skips authentication. An attacker can append '/login_admin.php' to the URL path of any PHP script under the manager HTML directory, causing the authentication check to be bypassed and allowing unauthenticated access to those scripts.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and gain unauthorized access to all PHP scripts under the manager HTML directory. This could lead to unauthorized administrative actions or data exposure within the affected application. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the manager HTML directory via network controls or web server configuration to prevent unauthorized access. Monitor for updates from Telenia Software regarding patches or official mitigations.