-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0310
============================================================

Advisory-ID:  0xCERT-2026-0310
Severity:     Low
Published:    2026-11-05T00:17:22.390Z
Updated:      2026-11-05T04:08:04.281Z
Chains:       Bitcoin
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0310

Title: CVE-2026-122049: A flaw has been found in Campcodes Bitcoin Wallet System 1

Summary
- -------
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

Details
- -------
Summary
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

Severity
Low (CVSS 2.9), as scored by NVD.

Weakness
- - CWE-307
- - CWE-799

Recommended actions
- - Check whether you run or depend on the affected component and version
- - Apply the vendor's fix or mitigation from the references below

Source & attribution
This 0xCERT advisory summarises CVE-2026-122049 from the U.S. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-122049. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://nvd.nist.gov/vuln/detail/CVE-2026-122049
- - https://tracexlabs.com/releases/campcodes-bitcoin-wallet-reset-code-flaws.html
- - https://vuldb.com/cve/CVE-2026-122049
- - https://vuldb.com/submit/1025182
- - https://vuldb.com/vuln/431126
- - https://vuldb.com/vuln/431126/cti
- - https://www.campcodes.com/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0Fgmrso9oJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmc6N21eRaD0N0nbs6V+znib+WnNq2MfyoIdpzcg
BC+3fhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAD9vgD+PVRu4RQF4cS6AHbr
2YslJxJCHjfDlOzZcwJC6R8NcxUA/iXeg0QtQwBZjQz1cIOLlo7UJoYvXTdq
UkWaF1ujJq4J
=xhRz
-----END PGP SIGNATURE-----