CVE-2026-22240
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red
- EPSS probability
- 3.12%
- CWE
- CWE-312, CWE-200, CWE-522
- Published
- 2026-01-14
- Last modified
- 2026-03-12
Affected products
- Bluspark Global BLUVOYIX
Weakness type
Related vulnerabilities
- CVE-2026-80058 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-86280 — SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storage
- CVE-2026-53603 — nebula-mesh: Operator session tokens stored in plaintext in the database
- CVE-2026-83551 — Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path
- CVE-2026-77975 — Ebyte NA111-M Cleartext Storage of Sensitive Information
- CVE-2026-82699 — sambitraj Student Management System Password aca.sql cleartext storage
- CVE-2026-82640 — browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
- CVE-2026-77970 — Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions