CVE-2026-64827
Received Received - Intake

Authentication Bypass in Telenia TVox via set_env.php

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-64827
EUVD
EUVD-2026-52292

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
telenia_software tvox to 26.5.3 (exc)
telenia_software tvox to 24.9.21 (exc)
telenia_software tvox 26.*
telenia_software tvox 24.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Telenia Software TVox versions up to 26.5.3 and 24.9.21 have an authentication bypass flaw in set_env.php. The function redirectToLoginAdminIRequestHaveAccessToken() checks the current page name from PHP_SELF and skips authentication if it matches 'login_admin.php'. Attackers can exploit this by appending '/login_admin.php' to any target PHP script path, bypassing authentication and gaining access to all PHP scripts in the manager HTML directory.

Detection Guidance

Check for unauthenticated access to PHP scripts under the manager HTML directory by appending '/login_admin.php' to target paths. Inspect server logs for unusual requests to 'login_admin.php' or direct access to sensitive scripts.

Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive PHP scripts in the manager HTML directory, potentially leading to unauthorized data access, system manipulation, or further exploitation of the application. It poses a high risk to confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR (data confidentiality) and HIPAA (protected health information). It may result in legal penalties, loss of trust, and failure to meet regulatory standards.

Mitigation Strategies

Update Telenia Software TVox to the latest patched version. If immediate update is not possible, restrict access to the manager HTML directory via server configuration or firewall rules. Review and remove any unnecessary PHP scripts in the directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart