CRITICAL🇵🇱 Wersja polska

CVE-2026-22240

CVSS 10.0v4.0pub. 2026-01-14upd. 2026-02-02

The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability results from two related errors: improper password storage (lack of hashing — CWE-522, CWE-312) and their exposure through an unauthenticated API endpoint (CWE-200). An attacker sends specially crafted HTTP requests to the vulnerable user API endpoint and receives passwords in plaintext in the response. They can then log in using the disclosed email address and administrator account password.

Impact

An attacker gains access to plaintext passwords of all platform users, enabling complete account takeover — including the administrator account — and unlimited access to all customer data.

Mitigation & patch

Apply patches available from the vendor according to the references (https://blusparkglobal.com/bluvoyix/). Until the fix is deployed, it is recommended to isolate access to vulnerable API endpoints at the firewall level and enforce password changes for all users after updating.

Who is affected

BLUVOYIX product by Blusparkglobal — versions specified in the vendor references.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Red