EUVD-2026-38237
GHSA-63h5-48q5-g43w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Registration endpoint is network-accessible with no demonstrated auth barrier; impact limited to low integrity (fake accounts created) and low availability (abuse/spam potential), with no confidentiality loss.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
Lifecycle Timeline
1DescriptionCVE.org
The vulnerability arises when the system fails to properly validate the 'email' field during the authentication process, allowing unverified or fake email addresses to be accepted. This lack of validation enables the creation of user accounts with fake email addresses, facilitating the mass creation of fraudulent accounts. Successful exploitation of this vulnerability could allow an authenticated attacker to carry out various attacks, such as mass spam distribution, system abuse, or bypassing user controls, thereby compromising the security and integrity of the system.
AnalysisAI
Email validation bypass in Gaudire's Assassin Game permits registration with arbitrary or non-existent email addresses, enabling automated mass account creation without real mailbox ownership verification. The CVSS 4.0 vector (PR:N, AV:N) indicates no prior authentication is required to trigger the flaw, though the description's contradictory reference to an 'authenticated attacker' has not been resolved by the vendor and warrants clarification before deploying mitigations. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is confined to service integrity abuse - spam distribution, rate-limit evasion, and fraudulent account accumulation.
Technical ContextAI
The affected product is Assassin Game by Gaudire (CPE: cpe:2.3:a:gaudire:assassin_game:*:*:*:*:*:*:*:*), a web application whose registration or authentication flow accepts the 'email' field without enforcing format validity, domain existence checks, or ownership verification via confirmation links. The assigned CWE is CWE-200 (Information Exposure), but this appears to be a classification discrepancy: the described root cause is the absence of server-side input validation and business-logic controls on the email field, which aligns more precisely with CWE-20 (Improper Input Validation) or CWE-840 (Business Logic Errors). CWE-200 typically denotes unintended data disclosure to unauthorized parties, which is not the primary mechanism here. The flaw is architectural - no email verification workflow (confirmation token, challenge-response) is enforced before account activation.
RemediationAI
No vendor-released patch version has been identified at time of analysis; the exact fix version is not independently confirmed from available data. Operators should monitor the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-assassin-game-gaudire) for patch availability. As specific compensating controls: enforce server-side email format validation conforming to RFC 5321 to reject malformed addresses at the API layer (note: format checks alone do not prevent use of real-but-unowned addresses); implement an email confirmation workflow that sends a tokenized activation link and holds accounts in a pending state until verified (this is the most effective control, as it ties each account to a reachable mailbox); apply rate limiting on the registration endpoint - for example, restricting account creation attempts per source IP per hour - to impede mass automation (trade-off: does not stop distributed creation or VPN/proxy abuse); and deploy CAPTCHA or bot-detection on signup flows to raise the cost of automation. Rate limiting and CAPTCHA should be treated as delay mechanisms, not substitutes for enforced email verification.
More in Assassin Game
View allMultiple chained vulnerabilities in Gaudire's Assassin Game platform allow an authenticated low-privileged player to tam
Sensitive information disclosure in Gaudire's Assassin Game application allows unauthenticated remote attackers to retri
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today