Why this deserves its current priority

CVSS is 5.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock.
2. 2Review the reported fix. Update TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock to 1.0.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 6, 2026

Sources and claim methodology

• Source referencesiberguvenlik.gov.tr

Related CVEs

• Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureSame generic ecosystem
• Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksSame generic ecosystem
• Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessSame generic ecosystem
• Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]Same generic ecosystem
• Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsSame generic ecosystem
• Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsSame generic ecosystem

Why this deserves its current priority

CVSS is 5.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock.
2. 2Review the reported fix. Update TÜBİTAK BİLGEM Software Technologies Research Institute/eta-otp-lock to 1.0.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 6, 2026

Sources and claim methodology

• Source referencesiberguvenlik.gov.tr

Related CVEs

• Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureSame generic ecosystem
• Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksSame generic ecosystem
• Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessSame generic ecosystem
• Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]Same generic ecosystem
• Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsSame generic ecosystem
• Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsSame generic ecosystem