CVE-2026-19906
Received Received - Intake

Insufficient Entropy in API Key Generation in pkp-lib

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulDB

Description
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-16
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-19906
EUVD
EUVD-2026-59789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pkp pkp-lib From 3.3.0 (inc) to 3.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-331 The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in pkp-lib versions 3.3.0, 3.4.0, and 3.5.0. It involves the APIProfileForm.php file where manipulating the apiKey argument in the setData function can lead to insufficient entropy. This means the API key generated may not have enough randomness, making it easier to predict or guess.

Detection Guidance

This vulnerability involves insufficient entropy in API key generation due to manipulation of the apiKey argument in the setData function of classes/user/form/APIProfileForm.php. Detection may require code review to check for proper entropy in API key generation and validation of input handling in the specified file.

Impact Analysis

An attacker could exploit this to generate predictable API keys, potentially gaining unauthorized access to sensitive functions or data. The remote attack requires high complexity but could lead to security breaches if successful.

Compliance Impact

The vulnerability involves insufficient entropy in API key generation, which could lead to predictable or weak keys. This may compromise data confidentiality and integrity, potentially violating GDPR's requirements for strong security measures and HIPAA's safeguards for protected health information.

Mitigation Strategies

Apply the patch 529b5df878e571ccc727647f7748eafc1466b041 to resolve the insufficient entropy issue in the API Key Generation component of pkp-lib.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart