CVE-2026-25235

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:24

Type	Values Removed	Values Added
Summary		(es) PEAR es un framework y sistema de distribución para componentes PHP reutilizables. Antes de la versión 1.33.0, los hashes de verificación predecibles podrían permitir a los atacantes adivinar tokens de verificación y potencialmente verificar solicitudes de cuentas de elección sin autorización. Este problema ha sido parcheado en la versión 1.33.0.

05 Feb 2026, 18:07

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
First Time		Pear Pear pearweb
CPE		cpe:2.3:a:pear:pearweb::::::::
References	~~() https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf -~~	() https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf - Vendor Advisory

03 Feb 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-03 19:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25235

Mitre link : CVE-2026-25235

CVE.ORG link : CVE-2026-25235

JSON object : View

Products Affected

pear

pearweb

CWE

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2026-25235", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25235", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T20:34:51.725693Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pear", "product": "pearweb", "versions": [{"status": "affected", "version": "< 1.33.0"}]}]}], "published": "2026-02-03T19:16:24.210", "references": [{"url": "https://github.com/pear/pearweb/security/advisories/GHSA-477r-4cmw-3cgf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-337"}]}], "descriptions": [{"lang": "en", "value": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0."}, {"lang": "es", "value": "PEAR es un framework y sistema de distribuci\u00f3n para componentes PHP reutilizables. Antes de la versi\u00f3n 1.33.0, los hashes de verificaci\u00f3n predecibles podr\u00edan permitir a los atacantes adivinar tokens de verificaci\u00f3n y potencialmente verificar solicitudes de cuentas de elecci\u00f3n sin autorizaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 1.33.0."}], "lastModified": "2026-06-17T10:24:21.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C609AFE-4E3A-4103-9AA0-9CEA5D0D87AD", "versionEndExcluding": "1.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}