PT-2026-2906 · Bluvoyix · Bluvoyix

Eaton Zveare · Published 2026-01-14 · Updated 2026-01-14 · CVE-2026-22240

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions BLUVOYIX (affected versions not specified)

Description The software contains a flaw related to insecure password storage and exposure through unauthenticated APIs. An unauthenticated remote attacker could potentially retrieve plaintext passwords of users by sending crafted HTTP requests to the users API. Successful exploitation may grant the attacker full access to customer data and complete compromise of the platform, potentially through login using an exposed admin email address and password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-312

CWE-522

Related Identifiers

CVE-2026-22240

Affected Products

Bluvoyix

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-22240 · Security Note
• https://blusparkglobal.com/bluvoyix · Note
• https://twitter.com/CVEnew/status/2011555219491176649 · Twitter Post