Pear
CVE-2026-25235
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify predictable verification hash algorithm
-
ExploitEnumerate weak token space
-
ExecutionGuess valid verification tokens
-
ImpactBypass election account authorization checks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Unpredictable PRNG seeds
|
| Exploitation Conditions | PEAR versions prior to 1.33.0 with election account verification feature enabled. Attacker must have network access to the PEAR installation endpoint accepting verification token submissions. No authentication required. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to guess verification tokens and potentially verify election account requests witho. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Pearweb versions up to 1.33.0 contains a vulnerability that allows attackers to guess verification tokens and potentially verify election account requests witho (CVSS 7.5).
RemediationAI
Fixed in version 1.33.0.. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
affects Pearweb. PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
Know when Pear gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
Executive ViewAI
Pearweb versions up to 1.33.0 contain a vulnerability allowing attackers to bypass election account verification controls by guessing security tokens. This directly threatens the integrity of election-related processes and could enable unauthorized account access, potentially compromising electoral data and system credibility.
Implement Web Application Firewall (WAF) rules to detect and block brute-force attempts against verification endpoints; enforce strict rate limiting on token submission (max 3 attempts per 15 minutes); add CAPTCHA challenges to verification forms; disable Pearweb's public-facing verification features if not operationally critical; restrict network access to Pearweb to trusted IP ranges only; implement token expiration windows shorter than current default; increase monitoring and alerting on account verification failures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenam
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. Rated critical severi
PEAR PHP framework has a code execution vulnerability through unsafe use of preg_replace() that allows attackers to exec
PEAR PHP framework has a seventh SQL injection with higher EPSS (0.12%), indicating more active scanning for this partic
PEAR PHP framework has another SQL injection vulnerability prior to version 1.33.0, the sixth in a series of critical se
PEAR PHP framework prior to 1.33.0 has a fifth SQL injection vulnerability, part of a comprehensive security audit that
PEAR PHP framework has a second SQL injection vulnerability in a different code path, providing an alternate database co
PEAR PHP framework prior to 1.33.0 has a SQL injection vulnerability allowing attackers to extract data from the compone
PEAR PHP framework prior to 1.33.0 has a logic bug in the roadmap feature allowing unauthorized access through incorrect
SQL injection in PEAR's apidoc queue insertion allows unauthenticated remote attackers to manipulate database queries by
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for
Exploit-DB