The vulnerability is an authentication bypass that occurs in TVox’s set_env.php script. When the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF, it mistakenly allows access if the value matches the literal string 'login_admin.php'. This flaw is classified as CWE-807, resulting in an unauthorized user being able to gain full read and execution permissions to any PHP script within the manager HTML directory without providing valid credentials.

The flaw affects Telenia Software’s TVox product versions 26.5.3 and earlier 26.x releases, as well as 24.9.21 and earlier 24.x releases. Any deployment of these versions that exposes the set_env.php endpoint is vulnerable.

With a CVSS score of 9.3, the flaw is considered critical. Although no EPSS data is provided, the absence of a CISA KEV listing does not mitigate the immediate threat; attackers can manually append '/login_admin.php' to any PHP script URL, causing the authentication check to be bypassed. The attack can be carried out remotely over standard web interfaces, and no privilege or user context is required beyond simple HTTP access.