PT-2026-35067 · Mojic · Mojic

Published 2026-04-16 · Updated 2026-04-25 · CVE-2026-41244

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mojic versions prior to 2.1.4

Description The CipherEngine uses a standard equality operator (!==) to verify the HMAC-SHA256 integrity seal during the decryption phase. This creates an Observable Timing Discrepancy, which is a situation where the time taken to execute a comparison depends on the input, allowing a potential attacker to bypass the file integrity check via a timing attack.

Recommendations Update to version 2.1.4.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-41244

GHSA-WQQ3-WFMP-V85G

Affected Products

Mojic

References · 6

• 🔥 https://github.com/notamitgamer/mojic/security/advisories/GHSA-wqq3-wfmp-v85g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41244 · Security Note
• https://osv.dev/vulnerability/GHSA-wqq3-wfmp-v85g · Vendor Advisory
• https://github.com/notamitgamer/mojic · Note
• https://twitter.com/CVEnew/status/2047798569244250181 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047872134572109854 · Twitter Post