Lagarto Chivato: Authentication flow pre-account hijacking (CVE-2026-126815)

Lagarto Chivato versions 0.4.1 and earlier contain a critical vulnerability in the authentication flow that allows remote, unauthenticated attackers to perform pre-account hijacking. Attackers can register accounts using specific email addresses that have not yet been registered in the system. When a victim subsequently attempts a passwordless login using that email, the attacker's pre-planted credentials become associated with the account, allowing the attacker to seize control.

Impact

The vulnerability enables full account takeover by unauthenticated attackers. This presents a high risk for unauthorized access to sensitive user data and administrative functions within the application.

Recommendation

• Immediately inventory all installations of Lagarto Chivato and identify any instances running version 0.4.1 or earlier.
• Since no patch version is currently specified, prioritize restricting public access to the registration and authentication endpoints of Lagarto Chivato until a fix is released.
• Audit logs for registration events to detect anomalies in email account creation patterns.