PT-2026-25050 · Stalin 143+1 · Website

Rootcrypt · CVE-2026-32138 · Published 2026-03-12 · Updated 2026-03-13

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions NEXULEAN versions prior to 2.0.0

Description Prior to version 2.0.0, the software exposed Firebase and Web3Forms API keys. An attacker could leverage these exposed keys to interact with backend services without proper authentication. This unauthorized access could potentially compromise application resources and user data.

Recommendations Update to version 2.0.0 or later.

Exploit

Fix

Using Hardcoded Credentials

Improper Access Control

Weakness Enumeration

CWE-798

CWE-284

Related Identifiers

CVE-2026-32138

GHSA-R7CR-5WCX-X9WM

Affected Products

Website

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32138.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-32138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32138 · Security Note
• https://github.com/Stalin-143/website/security/advisories/GHSA-r7cr-5wcx-x9wm · Note
• https://github.com/Stalin-143/website/releases/tag/v2.0.0 · Note
• https://twitter.com/TheHackerWire/status/2032185053195981202 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2032247335246245930 · Twitter Post
• https://twitter.com/CVEnew/status/2032230674669683067 · Twitter Post