What is the CVSS score of CVE-2026-18642?

CVE-2026-18642 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of eta-otp-lock are affected by CVE-2026-18642?

TUBITAK BILGEM's eta-otp-lock vulnerability (CVE-2026-18642) allows attackers with local system access to fully compromise affected hosts through malicious serialized payloads; no public exploit has…. A patch is available.

How to fix or mitigate CVE-2026-18642?

Within 24 hours, conduct a comprehensive inventory of all systems running eta-otp-lock and identify which are operating on versions prior to 1.0.4. Within 7 days, deploy eta-otp-lock version 1.0.4 to all affected systems per vendor advisory TR-26-0730 and verify successful patch application. Within 30 days, establish asset management controls to ensure continuous compliance monitoring and prevent regression to unpatched versions.

eta-otp-lock CVE-2026-18642

EUVD-2026-52294 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-03 TR-CERT

GHSA-wp8x-9jg9-r964

Deserialization Eta Otp Lock Tubitak Bilgem Software Technologies Research Institute

7.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector with user interaction reflects file-based deserialization delivery; PR:N because the attacker supplies an external payload without needing application credentials.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:30 vuln.today

Patch available

Aug 03, 2026 - 14:02 EUVD

CVE Published

Aug 03, 2026 - 13:31 nvd

HIGH 7.8

DescriptionCVE.org

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.

This issue affects eta-otp-lock: before 1.0.4.

AnalysisAI

Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). TR-CERT has confirmed the issue under advisory TR-26-0730; a vendor patch exists at version 1.0.4, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

eta-otp-lock is a software application developed by TUBITAK BILGEM (Scientific and Technological Research Council of Turkey - Informatics and Information Security Research Center) for OTP-based authentication or access locking. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the application deserializes externally supplied data without sufficient validation, enabling an attacker to inject specially crafted objects into the deserialization stream. Depending on the available gadget chains in the application's runtime environment and class libraries, such object injection can escalate to arbitrary code execution. The affected CPE is cpe:2.3:a:tubitak_bilgem_software_technologies_research_institute:eta-otp-lock:*:*:*:*:*:*:*:*, covering all versions up to but not including 1.0.4.

RemediationAI

Upgrade eta-otp-lock to version 1.0.4 or later, as confirmed by the vendor and TR-CERT advisory TR-26-0730 at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0730. As an interim compensating control prior to patching, restrict filesystem permissions on directories where eta-otp-lock reads data, preventing untrusted users from placing files there - this directly disrupts the delivery phase of the attack chain, though it requires careful access-control review to avoid operational disruption. Additionally, user awareness guidance to avoid opening or processing files received from untrusted sources within the application limits exploitation given the UI:R prerequisite. Neither compensating control eliminates the vulnerability; patching to 1.0.4 is the definitive fix.