CVE-2026-64827

Name of the Vulnerable Software and Affected Versions Telenia Software TVox versions prior to 26.5.3 Telenia Software TVox versions prior to 24.9.21

Description An authentication bypass exists in the set env.php file. The redirectToLoginAdminIRequestHaveAccessToken() function determines the current page name using the PHP SELF variable and fails to require authentication if the value matches 'login admin.php'. An attacker can bypass security checks and gain unauthorized access to all PHP scripts within the manager HTML directory by appending '/login admin.php' to the path of any target PHP script.

Recommendations Update Telenia Software TVox to a version later than 26.5.3. Update Telenia Software TVox to a version later than 24.9.21.