CVE-2026-122049: A flaw has been found in Campcodes Bitcoin Wallet System 1
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Vuln-watch · relayed from the NVD / CVE program; see Source & attribution below
Summary
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Severity
Low (CVSS 2.9), as scored by NVD.
Weakness
- CWE-307
- CWE-799
Recommended actions
- Check whether you run or depend on the affected component and version
- Apply the vendor's fix or mitigation from the references below
Source & attribution
This 0xCERT advisory summarises CVE-2026-122049 from the U.S. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-122049. Details may change; refer to the original source for the authoritative record.
References
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-11-05 · last updated 2026-11-05
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0310/signed.txt | gpg --verify