Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. (CVE-2026-18642)
A deserialization of untrusted data vulnerability exists in TUBITAK BILGEM Software Technologies Research Institute's eta-otp-lock before version 1.0.4. This vulnerability allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-18642 and has a CVSS 3.1 score of 7.8, indicating high severity.
AI Analysis
Technical Summary
CVE-2026-18642 is a vulnerability in eta-otp-lock prior to version 1.0.4 caused by deserialization of untrusted data, enabling object injection attacks. This can result in an attacker manipulating serialized objects to execute arbitrary code or alter program behavior. The vulnerability has a CVSS v3.1 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could inject malicious objects during deserialization, potentially executing arbitrary code or causing denial of service conditions.
Mitigation Recommendations
A fixed version 1.0.4 or later should be applied to remediate this vulnerability. Since no patch links or vendor advisories are provided, confirm patch availability from the vendor or official sources. Until patched, avoid deserializing untrusted data in eta-otp-lock and apply any recommended temporary mitigations from the vendor.
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. (CVE-2026-18642)
Description
A deserialization of untrusted data vulnerability exists in TUBITAK BILGEM Software Technologies Research Institute's eta-otp-lock before version 1.0.4. This vulnerability allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-18642 and has a CVSS 3.1 score of 7.8, indicating high severity.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18642 is a vulnerability in eta-otp-lock prior to version 1.0.4 caused by deserialization of untrusted data, enabling object injection attacks. This can result in an attacker manipulating serialized objects to execute arbitrary code or alter program behavior. The vulnerability has a CVSS v3.1 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could inject malicious objects during deserialization, potentially executing arbitrary code or causing denial of service conditions.
Mitigation Recommendations
A fixed version 1.0.4 or later should be applied to remediate this vulnerability. Since no patch links or vendor advisories are provided, confirm patch availability from the vendor or official sources. Until patched, avoid deserializing untrusted data in eta-otp-lock and apply any recommended temporary mitigations from the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wp8x-9jg9-r964
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18642"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a710669bf32cb7a34394ef4
Added to database: 08/03/2026, 21:21:45 UTC
Last enriched: 08/03/2026, 21:33:27 UTC
Last updated: 08/04/2026, 03:17:47 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.