CVE-2026-111679

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111679

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111679.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111679

Published

2026-10-16T17:39:38Z

Modified

2026-10-17T02:49:08Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Details

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111679.json"
}

References

Affected packages

Git / github.com/ekkolearnai/ekko-studio

Affected ranges

Type

GIT

Repo

https://github.com/ekkolearnai/ekko-studio

Events

Introduced

Last Affected

1242ac63556491c92ba6dd49d89fd19c91a6bdd5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.7.36"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.17.0

0.2.3

0.3.0

0.3.1

0.3.8

0.4.4

0.5.33

0.5.34

0.5.35

0.6.8-beta

0.6.8-beta-2

hermes-0.*

hermes-0.15.2-runtime

hermes-0.15.2-runtime-test

hermes-0.16.0-runtime

hermes-0.17.0-runtime

hermes-0.18.0-runtime

hermes-0.18.2-runtime

hermes-0.19.0-runtime

hermes-0.19.1-runtime

hermes-0.20.0-runtime

hermes-0.20.4-runtime

hermes-0.20.6-runtime

hermes-0.21.0-runtime

hermes-0.21.3-runtime

hermes-0.21.5-runtime

hermes-0.22.2-runtime

Other

stt-zipformer-bilingual-zh-en-int8-2023-02-20

v0.*

v0.1.4

v0.1.5

v0.1.9

v0.2.0

v0.2.0-beta.1

v0.2.5

v0.3.5

v0.3.6

v0.3.7

v0.4.1

v0.4.2

v0.4.5

v0.4.6

v0.5.10

v0.5.12

v0.5.13

v0.5.15

v0.5.16

v0.5.17

v0.5.18

v0.5.2

v0.5.20

v0.5.21

v0.5.22

v0.5.23

v0.5.24

v0.5.25

v0.5.28

v0.5.3

v0.5.30

v0.5.32

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.10

v0.6.10-beta

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.21

v0.6.22

v0.6.23

v0.6.24

v0.6.25

v0.6.26

v0.6.27

v0.6.28

v0.6.29

v0.6.3

v0.6.30

v0.6.31

v0.6.32

v0.6.33

v0.6.34

v0.6.35

v0.6.36

v0.6.37

v0.6.38

v0.6.39

v0.6.4

v0.6.40

v0.6.42

v0.6.43

v0.6.44

v0.6.45

v0.6.46

v0.6.47

v0.6.5

v0.6.6

v0.6.7

v0.6.9

v0.7.0

v0.7.1

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.19

v0.7.20

v0.7.21

v0.7.22

v0.7.23

v0.7.24

v0.7.25

v0.7.26

v0.7.27

v0.7.28

v0.7.29

v0.7.30

v0.7.31

v0.7.32

v0.7.33

v0.7.34

v0.7.35

v0.7.36

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111679.json"