{"id":"CVE-2023-46754","details":"The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.","modified":"2026-10-28T02:31:13.336491960Z","published":"2023-10-26T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46754.json"},"references":[{"type":"WEB","url":"https://github.com/obl-ong/admin/releases/tag/v1.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46754.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46754"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/obl-ong/panel","events":[{"introduced":"0"},{"fixed":"a0dd15f11329737c238bc7cbb0ad13c35c9272e3"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.1.2"}],"source":"DESCRIPTION"},{"range":[{"fixed":"a0dd15f11329737c238bc7cbb0ad13c35c9272e3"}],"source":"REFERENCES_TAG","original_tag":"v1.1.2"},{"cpe":"cpe:2.3:a:obl.ong:admin:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"1.1.2"}],"source":"CPE_RANGE"}]}}],"versions":["v1.1.1","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46754.json"}}],"schema_version":"1.9.2"}