High · 7.8 CVE-2026-18642 EUVD-2026-52294GHSA-wp8x-9jg9-r964

Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Published Aug 3, 2026 · Updated Aug 3, 2026 · Assigned by TR-CERT

Description

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.

This issue affects eta-otp-lock: before 1.0.4.

Vendor	Product	Affected	Fixed
TUBITAK BILGEM Software Technologies Research Institute	eta-otp-lock	< 1.0.4	1.0.4