CVE-2026-19806

Name of the Vulnerable Software and Affected Versions Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System versions prior to 1.4.53

Description An authentication bypass exists that allows for administrator account takeover. The issue resides in the guest ticket login() function and its p parameter. The site-wide AES-256-CBC encryption key is generated using a low-entropy process involving three two-digit wp rand(10, 99) values and a Unix timestamp via md5(), resulting in approximately 19.5 bits of entropy. Additionally, the plugin uses a deterministic IV derived from the password and lacks authentication tags on ciphertext, capability checks, nonces, or session validation on the /sgnix/?p=<token> endpoint. Attackers with subscriber-level access or higher can use a legitimate guest ticket token as a known-plaintext oracle to recover the encryption key offline. By forging a {ticket id, ticket user} token for an administrator-owned ticket and submitting it to the endpoint, the wp set auth cookie() function is triggered, granting full administrative access to the site.

Recommendations Update the plugin to a version later than 1.4.52. As a temporary workaround, restrict access to the /sgnix/?p=<token> endpoint to minimize the risk of exploitation.