CVE-2026-25235 — PEAR Has a Predictable Verification Hash in Election Account Requests

CVE-2026-25235

PEAR Has a Predictable Verification Hash in Election Account Requests PUBLISHED

Description (CNA)

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.

Affected (CNA)

Vendor / product	Versions
pear / pearweb	affected < 1.33.0

CWE

CWE-337

References

https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.