CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Apache Answer email-code confusion through 2.0.2 may allow account takeover.
Apache disclosed CVE-2026-67249 in Apache Answer through 2.0.2. A verification code issued for one email-based workflow can be accepted by another sensitive workflow because the code's purpose is not enforced, which may allow account takeover. Apache rates the issue moderate and recommends upgrading to 2.0.3. Reporter credit goes to Arpit Jain; no active exploitation is stated.
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Email verification codes are not bound to their intended workflow.
- A code from one flow may be accepted by a sensitive flow, enabling account takeover.
- Vendor severity is moderate; reported by Arpit Jain.
- CVEs
- CVE-2026-67249
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-67249 | A vulnerability in Apache Answer | 5.4 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: A vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.