CVE-2026-19906

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19906
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19906.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19906
Published
2026-08-15T19:00:10Z
Modified
2026-08-22T03:31:00Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
pkp pkp-lib API Key Generation APIProfileForm.php setData entropy
Details

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-330",
        "CWE-331"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19906.json"
}
References

Affected packages

Git / github.com/pkp/pkp-lib

Affected ranges

Type
GIT
Repo
https://github.com/pkp/pkp-lib
Events
Introduced
3d9dd8a2806ddae81787cd25a3f189c9578ebcf6
Fixed
529b5df878e571ccc727647f7748eafc1466b041
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.3.0"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.4.0"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "last_affected": "3.5.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.3.0
3.4.0
3.5.0
Other
3_3_0-0
3_3_0-1
3_4_0-0
3_4_0rc1
3_4_0rc2
3_4_0rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19906.json"