Back to overview

CVE-2026-22240

CRITICAL
10.0
CVSS 4.0
Description
The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.

Metadata

CVE ID
CVE-2026-22240
State
PUBLISHED
Assigner
MHV
Reserved
2026-01-06 23:20 UTC
Published
2026-01-14 14:42 UTC
Last updated
2026-01-14 14:58 UTC
Primary CWE
CWE-312
CWE-312 Cleartext Storage of Sensitive Information
Vendor / Product
Bluspark Global / BLUVOYIX
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Bluspark Global BLUVOYIX — —
Weakness (CWE)
CWESourceDescription
CWE-200 cna CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-312 cna CWE-312 Cleartext Storage of Sensitive Information
CWE-522 cna CWE-522 Insufficiently Protected Credentials
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red
References (1)
Back to overview