Threats tagged 'ghsa-f39m-86jx-7p47'

A pre-account hijacking vulnerability exists in the authentication flow of Lagarto Chivato version 0.4.1 and earlier on the web. This flaw allows remote unauthenticated attackers to take over arbitrary user accounts by planting a password on an unregistered email address, which becomes valid when the victim performs their first passwordless login.