CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Merged summary · from the lead articleSummaries by Vani AI
Apache Answer email-code confusion through 2.0.2 may allow account takeover.
Apache disclosed CVE-2026-67249 in Apache Answer through 2.0.2. A verification code issued for one email-based workflow can be accepted by another sensitive workflow because the code's purpose is not enforced, which may allow account takeover. Apache rates the issue moderate and recommends upgrading to 2.0.3. Reporter credit goes to Arpit Jain; no active exploitation is stated.
Key facts
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Email verification codes are not bound to their intended workflow.
- A code from one flow may be accepted by a sensitive flow, enabling account takeover.
- Vendor severity is moderate; reported by Arpit Jain.
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Coverage
oldest first · one row per article · UTC- · 14d ago
oss-securityFirst report
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Apache Answer through 2.0.2 logs full API keys in plaintext; 2.0.3 stops the leak.
- · 14d ago
CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Apache Answer email-code confusion through 2.0.2 may allow account takeover.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64943 | API keys written to logs in Apache Answer through 2.0.2 | 8.1 | — | ||
| CVE-2026-67249 | A vulnerability in Apache Answer | 5.4 | — | ||
| CVE-2026-71563 | Missing Authorization vulnerability in Apache Answer | 4.3 | — | ||
| CVE-2026-79624 | Insufficient session expiration vulnerability in Apache Answer | — | — | ||
| CVE-2026-86589 | Incorrect implementation of authentication algorithm vulnerability in Apache Answer | 5.4 | — | ||
| CVE-2026-90910 | Missing auth on Apache Answer reaction API through 2.0.2 | 9.8 | — |