CVE-2026-18642 PUBLISHED

Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Assigner: TR-CERT
Reserved: 03.08.2026 Published: 03.08.2026 Updated: 03.08.2026

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.

This issue affects eta-otp-lock: before 1.0.4.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Product Status

Vendor TUBITAK BILGEM Software Technologies Research Institute
Product eta-otp-lock
Versions Default: unaffected
  • affected from 0 to 1.0.4 (excl.)

Credits

  • Emirhan YÜCEL finder

References

Problem Types

  • CWE-502 Deserialization of untrusted data CWE

Impacts

  • CAPEC-586 Object Injection