CVE-2026-18642

HighCVSS 7.8

Published: 03/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 03/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.

Risk Assessment

The organization is at risk of remote code execution or other attacks due to deserialization of untrusted data, potentially leading to system compromise.

Recommendation

Upgrade eta-otp-lock to version 1.0.4 or later, which includes a fix for the deserialization issue.

Other vulnerabilities in eta-otp-lock

CVE-2026-18915Medium
A vulnerability in eta-otp-lock before 1.0.4 allows invocation of a process using visible sensitive information, enabling system footprinting.

Original NVD description (English source)

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.