Lagarto Chivato (<= 0.4.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/lagarto-chivato--0.4.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:12:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLagarto Chivato: Authentication flow pre-account hijacking (CVE-2026-126815)https://feed.craftedsignal.io/briefs/2026-11-lagarto-chivato-hijack-cve-2026-126815/Wed, 11 Nov 2026 22:12:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-lagarto-chivato-hijack-cve-2026-126815/Lagarto Chivato versions 0.4.1 and earlier are vulnerable to pre-account hijacking, allowing unauthenticated attackers to take over arbitrary accounts by registering accounts with specific email addresses.Lagarto Chivato versions 0.4.1 and earlier contain a critical vulnerability in the authentication flow that allows remote, unauthenticated attackers to perform pre-account hijacking. Attackers can register accounts using specific email addresses that have not yet been registered in the system. When a victim subsequently attempts a passwordless login using that email, the attacker's pre-planted credentials become associated with the account, allowing the attacker to seize control.

Impact

The vulnerability enables full account takeover by unauthenticated attackers. This presents a high risk for unauthorized access to sensitive user data and administrative functions within the application.

Recommendation

  • Immediately inventory all installations of Lagarto Chivato and identify any instances running version 0.4.1 or earlier.
  • Since no patch version is currently specified, prioritize restricting public access to the registration and authentication endpoints of Lagarto Chivato until a fix is released.
  • Audit logs for registration events to detect anomalies in email account creation patterns.
]]>highadvisorycve-2026-126815vulnerabilitywebserveraccount-takeover