Home

Description

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.

PUBLISHED Reserved 2026-01-30 | Published 2026-02-03 | Updated 2026-02-04 | Assigner GitHub_M




HIGH: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)

Product status

< 1.33.0
affected

References

github.com/...earweb/security/advisories/GHSA-477r-4cmw-3cgf

cve.org (CVE-2026-25235)

nvd.nist.gov (CVE-2026-25235)

Download JSON