TI-2026-16139 Aliases CVE-2026-19906 GHSA-gccx-9qmf-hrf5

pkp pkp-lib API Key Generation APIProfileForm.php setData entropy

LOW 29CWE-330Published 2026-08-15 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00493 42nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pkp	pkp-lib	3.3.0; 3.4.0; 3.5.0	—	No fix listed	CNA

pkp-lib Vendorpkp Affected 3.3.0; 3.4.0; 3.5.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pkp:pkp-lib::::::::	—	—	pkp

cpe:2.3:a:pkp:pkp-lib:*:*:*:*:*:*:*:* Versions — — ·pkp

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-19906
2026-10-03 Alias added: GHSA-gccx-9qmf-hrf5

References

Patch 1

https://github.com/pkp/pkp-lib/commit/529b5df878e571ccc727647f7748eafc1466b041

Other 2

TI-2023-05431 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
TI-2023-05430 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
TI-2023-05429 Cross-Site Request Forgery (CSRF) in pkp/customLocale CVSS 3.1HIGH 8.8
TI-2023-05425 Cross-Site Request Forgery (CSRF) in pkp/pkp-lib CVSS 3.1HIGH 8.8
TI-2023-05178 Cross-Site Request Forgery (CSRF) in pkp/ojs CVSS 3.1HIGH 8.8
TI-2023-04327 Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib CVSS 3.1HIGH 8.1

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences