CVE-2026-64827

Telenia TVox 26.5.3 Authentication Bypass via set_env.php

Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

Analysis

Technical impact

The vulnerability is an authentication bypass that occurs in TVox’s set_env.php script. When the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF, it mistakenly allows access if the value matches the literal string 'login_admin.php'. This flaw is classified as CWE-807, resulting in an unauthorized user being able to gain full read and execution permissions to any PHP script within the manager HTML directory without providing valid credentials.

Affected Systems

The flaw affects Telenia Software’s TVox product versions 26.5.3 and earlier 26.x releases, as well as 24.9.21 and earlier 24.x releases. Any deployment of these versions that exposes the set_env.php endpoint is vulnerable.

Risk and Exploitability

With a CVSS score of 9.3, the flaw is considered critical. Although no EPSS data is provided, the absence of a CISA KEV listing does not mitigate the immediate threat; attackers can manually append '/login_admin.php' to any PHP script URL, causing the authentication check to be bypassed. The attack can be carried out remotely over standard web interfaces, and no privilege or user context is required beyond simple HTTP access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Telenia Software

TVox

affected

Version	Status	Constraints
`26.0.0`	affected	≤ 26.5.3
`24.0.0`	affected	≤ 24.9.21

No data.

Vendor Product Versions

Teleniasoftware

Tvox

Version	Status	Scheme	Platform
`[26.0.0,26.5.3]`	affected	semver	—
`[24.0.0,24.9.21]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor-provided patch for TVox 26.5.3 or upgrade to a version that has remediated the set_env.php flaw; verify the patch removes the PHP_SELF authentication bypass.
If a patch or upgrade is not immediately available, restrict remote access to the manager HTML directory by configuring the web server (e.g., with .htaccess rules) to deny requests that contain 'login_admin.php' in the path, thereby preventing the bypass from being triggered.
After implementing a fix or restriction, conduct a quick test by requesting the path <target>/set_env.php/login_admin.php; a successful request should now enforce authentication and return a 401/302 redirect rather than granting access.

Generated by OpenCVE AI on August 4, 2026 at 10:15 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.830% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
http://seclists.org/fulldisclosure/2026/Aug/30
https://karmainsecurity.com/KIS-2026-14
https://www.teleniasoftware.com/
https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php

History

Aug 3, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 3, 2026 2:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Teleniasoftware Teleniasoftware tvox
Vendors & Products		Teleniasoftware Teleniasoftware tvox

Aug 3, 2026 1:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
Title		Telenia TVox 26.5.3 Authentication Bypass via set_env.php
Weaknesses		CWE-807
References		https://karmainsecurity.com/KIS-2026-14 https://www.teleniasoftware.com/ https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`