Lagarto Chivato: Pre-account hijacking via planted password
Summary
Lagarto Chivato, a passwordless web application, allows an unauthenticated remote attacker to take over arbitrary user accounts. The attacker plants a password on an email address that has not yet registered, and the account becomes accessible once the victim first logs in without a password. No user credentials are needed, but the victim must perform a passwordless login, which is why user interaction is required.
Affected
- XauenDevs Lagarto Chivato 0.1.0 to 0.4.2 (per the CVE record); the description mentions 0.4.1 and earlier
- Conflicting information: some sources list the range up to 0.4.1 or 0.4.3
- Unknown whether this applies to every deployment configuration
Fixed in
- Unknown. The CVE record lists 0.4.4 as unaffected, but this is not yet confirmed by the vendor advisory for this CVE.
Workaround
- Unknown.
Exploitation
- No known exploitation in the wild at the time of writing.
- No public proof-of-concept found.
Our recommendation
- Check whether Lagarto Chivato is used in your environment and whether it is internet-facing.
- Upgrade to version 0.4.4 or later once the vendor confirms the fix, and verify the fixed version in the Grayback advisory.
- Until a fix is applied, restrict access to the application and review accounts that were created or first used via passwordless login for unexpected activity.
- Monitor the vendor advisory and CISA KEV for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Grayback security advisories (EN) www.grayback.es
- Grayback security advisories (ES) www.grayback.es
- VulDB entry for sibling CVE with version data vuldb.com
- Account pre-hijacking background en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:21.
Original description (NVD)
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.