What is the CVSS score of EUVD-2026-53819?

EUVD-2026-53819 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-53819?

Yes, a patch is available for EUVD-2026-53819. Update the affected software to the latest version immediately.

eta-otp-lock EUVD-2026-53819

| CVE-2026-18915 MEDIUM

Invocation of Process Using Visible Sensitive Information (CWE-214)

2026-08-06 TR-CERT

GHSA-2x9j-ppfr-c4pq

Information Disclosure Eta Otp Lock T Bi Tak Bi Lgem Software Technologies Research Institute

5.0

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.0 MEDIUM

Local-only attack requiring low-privilege account and active user OTP invocation; OTP secret exposure yields high confidentiality impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 09:01 EUVD

Analysis Generated

Aug 06, 2026 - 08:35 vuln.today

DescriptionCVE.org

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.

This issue affects eta-otp-lock: before 1.0.4.

AnalysisAI

eta-otp-lock before version 1.0.4 exposes sensitive information - likely OTP codes or credentials - as visible process arguments during invocation, enabling local system footprinting by other users. The vulnerability maps to CWE-214, where secrets passed via command-line arguments or process environment can be read by any local user through standard OS interfaces such as /proc or ps. No public exploit code exists and the product is not listed in CISA KEV, but the high confidentiality impact reflects the sensitivity of OTP material if intercepted.

Technical ContextAI

CWE-214 (Invocation of Process Using Visible Sensitive Information) occurs when a process passes credentials, tokens, or OTP values as command-line arguments or in a way observable through OS-level process inspection tools. On Linux, /proc/<pid>/cmdline and utilities like 'ps aux' expose all argument strings to local users with appropriate permissions. For an OTP-based lock utility - which by design handles time-sensitive, single-use authentication codes - this exposure is particularly damaging, as captured codes may be immediately reusable before expiry. The affected product is cpe:2.3:a:tübi̇tak_bi̇lgem_software_technologies_research_institute:eta-otp-lock:*:*:*:*:*:*:*:*, developed by TÜBİTAK BİLGEM, a Turkish government software research institute.

RemediationAI

Upgrade to eta-otp-lock version 1.0.4 or later, which resolves the visible sensitive information exposure per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0753. If immediate patching is not possible, restrict local shell access on systems running eta-otp-lock to only trusted users, as the attack requires local user-level access (PR:L). Additionally, audit and tighten /proc access controls - on Linux, kernel.yama.ptrace_scope or hidepid mount options for /proc can reduce visibility of process arguments to non-owning users. Note that hidepid does not protect against root or processes with CAP_SYS_PTRACE, so privilege separation controls must also be enforced.