CVE-2026-118459
Received Received - Intake

Time-Based Emergency Password Bypass in Application

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: ENISA

Description
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-118459

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
CompuGroup Medical Infantia From 0 (inc) to 5.1.1 (inc)
CompuGroup Medical Profim From 0 (inc) to 5.1.1 (inc)
CompuGroup Medical Venere From 0 (inc) to 5.1.1 (inc)
CompuGroup Medical Phronesis From 0 (inc) to 5.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to derive an emergency password from publicly available application code. This password can then be used to authenticate without legitimate credentials, bypassing normal authentication mechanisms.

Impact Analysis

An attacker could gain unauthorized access to the affected systems, potentially leading to data breaches, unauthorized modifications, or other malicious activities. This could affect patient data in medical applications or sensitive information in other systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (healthcare data privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Disable or restrict emergency password functionality in affected CompuGroup Medical applications until a patch is applied. Review application code for hardcoded or predictable emergency password logic and remove it. Monitor authentication logs for unauthorized access attempts using derived passwords.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...