Technical impact
A flaw in the PEAR framework allows attackers to predict verification hashes used in election account requests. If an attacker can guess these tokens, they may validate account requests without authorization, potentially compromising the integrity of election accounts. The weakness is a predictable random value (CWE-337).
Affected Systems
The vulnerability affects the PEAR framework, specifically versions prior to 1.33.0. All builds of pearweb before the listed patch are susceptible.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity risk. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via crafted HTTP requests to the election account verification endpoint, enabling an attacker to enumerate or forge valid tokens.
