CVE-2026-19127

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A flaw in the billing and license activation subsystem enables remote, unauthenticated attackers to bypass payment authorization workflows. The issue stems from insufficient cryptographic validation or a lack of server-side state verification regarding promotional and lifetime-deal (LTD) redemption codes. This allows attackers to forge valid redemption tokens or replay single-use codes to activate the highest-tier paid subscriptions without completing a financial transaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.