CVE-2026-122049: medium-severity vulnerability in Campcodes Bitcoin Wallet System
Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
30Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.3
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Campcodes · Bitcoin Wallet Systempublic PoCs found — 1
cve_referencetracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.