AIP-PUB ACPs-community: Improper Authentication in verify-code Endpoint (CVE-2026-127278)
AIP-PUB ACPs-community up to 2.2.0 contains an improper authentication vulnerability in the send_verification_code function that can be triggered remotely via manipulation of the phone argument.
CVE search metadata
CVE search record: CVE-2026-127278. Severity: high. CVSS: 7.3. KEV: no. Product: ACPs-community. Brief: AIP-PUB ACPs-community: Improper Authentication in verify-code Endpoint (CVE-2026-127278). Brief link: https://feed.craftedsignal.io/briefs/2026-11-acps-community-auth-bypass-cve-2026-127278/
Triage facts
Revision 1- Applicability
- ACPs-community
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 02:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability (CVE-2026-127278) has been identified in the AIP-PUB ACPs-community component in versions up to 2.2.0. The vulnerability exists within the 'send_verification_code' function in 'registry-server/app/account/service_auth.py'. The verify-code endpoint can be exploited remotely by manipulating the 'phone' argument, resulting in improper authentication. The exploit code has been made available to the public. While a related GitHub issue was closed as 'completed', there is no identified commit or pull request confirming a fix.
Impact
Successful exploitation results in improper authentication.
Recommendation
Monitor the environment for the identified vulnerable component and assess exposure to the verify-code endpoint.