Apache Answer 2.0.2 Verification Code Reuse Vulnerability
CVE-2026-67249 Published on October 19, 2026
Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-67249 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-67249
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.