Description
A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Published: 2026-11-04
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Patch Now
AI Analysis

Impact

The flaw lies in the random_int function used by ForgotPasswordController in the Campcodes Bitcoin Wallet System. By manipulating the output of random_int, an attacker can bypass the intended restriction on excessive authentication attempts. This enables remote exploitation that can lead to unauthorized password resets or brute‑force access. The weakness is classified as an authentication bypass (CWE‑307) and excessive authentication (CWE‑799).

Affected Systems

Campcodes:Bitcoin Wallet System version 1.0 is affected. No additional product versions are identified in the CNA data.

Risk and Exploitability

This vulnerability has a CVSS score of 6.3, indicating moderate severity. The EPSS score is not available, and it has not yet been listed in the CISA KEV catalog. The attack complexity is rated high and exploitability difficult, yet an exploitation method has been published and may be used. The likely attack vector is a remote web interface that processes password reset requests, so attackers can trigger the flaw from anywhere with network access.

Generated by OpenCVE AI on November 5, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Campcodes Bitcoin Wallet System to the latest released version that contains the patch for the random_int issue.
  • Enforce stricter rate limiting on password reset or login attempts, either through application settings or an external firewall, to prevent abuse of the flawed authentication control.
  • Monitor authentication logs for abnormal reset attempts and apply an account lockout policy after repeated failures to mitigate potential brute‑force attacks.

Generated by OpenCVE AI on November 5, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.
Title Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication
First Time appeared Campcodes
Campcodes bitcoin Wallet System
Weaknesses CWE-307
CWE-799
CPEs cpe:2.3:a:campcodes:bitcoin_wallet_system:*:*:*:*:*:*:*:*
Vendors & Products Campcodes
Campcodes bitcoin Wallet System
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Campcodes Bitcoin Wallet System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-04T23:15:11.070Z

Reserved: 2026-11-04T15:58:50.626Z

Link: CVE-2026-122049

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-05T00:17:22.390

Modified: 2026-11-05T00:17:23.717

Link: CVE-2026-122049

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T00:30:07Z

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts

  • CWE-799

    Improper Control of Interaction Frequency