Description
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XauenDevs | Lagarto Chivato | 0.1.0 ≤0.4.2 | — |