CVE-2026-19906
pkp pkp-lib API Key Generation APIProfileForm.php setData entropy
- State
- Published
- Severity
- 6.3 Medium
- Published
- Aug 15, 2026
- Updated
- Aug 17, 2026
- Reserved
- Aug 14, 2026
Description
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C | VulDB |
| 3.0 | 3.7 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C | VulDB |
| 2.0 | 2.6 Low | AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
pkp-libpkp |
|
References
- VDB-390119 | pkp pkp-lib API Key Generation APIProfileForm.php setData entropyvdb-entrytechnical-description
- VDB-390119 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-19906 | CVE Analysis and Reportthird-party-advisory
- Submit #870828 | Public Knowledge Project ojs, pkp-lib 3.5.0 Predictable API Key Generationthird-party-advisory
- https://github.com/pkp/pkp-lib/issues/12951issue-tracking
- https://github.com/pkp/pkp-lib/commit/529b5df878e571ccc727647f7748eafc1466b041patch
- https://github.com/pkp/pkp-lib/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.