CVE-2026-64827: Telenia TVox Auth Bypass Vulnerability

CVE-2026-64827 Overview

CVE-2026-64827 is an authentication bypass vulnerability in Telenia Software TVox affecting versions 26.5.3 and prior 26.x releases, along with 24.9.21 and prior 24.x releases. The flaw resides in set_env.php, where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from the PHP_SELF server variable. When the derived value matches login_admin.php, the function skips authentication entirely. Attackers can append /login_admin.php to any target script path and gain unauthenticated access to every PHP script under the manager HTML directory. The vulnerability is categorized under [CWE-807: Reliance on Untrusted Inputs in a Security Decision].

Critical Impact
Unauthenticated remote attackers can access administrative PHP endpoints by manipulating the request path, exposing management functionality without credentials.

Affected Products

Telenia Software TVox 26.x through 26.5.3
Telenia Software TVox 24.x through 24.9.21
Manager HTML directory PHP scripts protected by set_env.php

Discovery Timeline

2026-08-03 - CVE-2026-64827 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-64827

Vulnerability Analysis

The vulnerability exists in the redirectToLoginAdminIRequestHaveAccessToken() function within set_env.php. This function is intended to allow unauthenticated access only to the login page while enforcing authentication for every other administrative script. To determine whether a request targets the login page, the function extracts the current page name from $_SERVER['PHP_SELF'] and compares it to the literal string login_admin.php. If the comparison succeeds, the authentication check is bypassed and script execution continues.

The PHP_SELF variable is derived from the requested URI and includes any path components appended after the script name when PATH_INFO handling is enabled. Attackers can craft a URL such as /manager/html/target_script.php/login_admin.php, causing PHP to execute target_script.php while PHP_SELF terminates in login_admin.php. The naive string comparison returns true and the guard clause returns early, granting access to the underlying script without a valid session.

Root Cause

The root cause is reliance on an untrusted input for a security decision. PHP_SELF is attacker-controllable through path manipulation and must not be used as an authoritative identifier for the executing script. A correct implementation would compare basename(__FILE__) or SCRIPT_FILENAME, values that reflect the actual file being served rather than the client-supplied URL.

Attack Vector

Exploitation requires only network access to the TVox manager interface and no prior authentication or user interaction. An attacker issues an HTTP request to any target PHP script under the manager HTML directory with /login_admin.php appended to the path. The web server routes execution to the target script, set_env.php evaluates the manipulated PHP_SELF, and the authentication guard is skipped. All PHP scripts under the manager HTML directory become accessible, including administrative functions that expose configuration and telephony management surfaces.

Refer to the KarmaInSecurity Advisory KIS-2026-14 and the VulnCheck Advisory: Telenia TVOX Bypass for additional technical details.

Detection Methods for CVE-2026-64827

Indicators of Compromise

HTTP requests to manager HTML directory scripts containing the suffix /login_admin.php appended to another .php path component.
Access log entries showing successful 200 responses to administrative endpoints without a preceding successful authentication event.
Session-less requests reaching scripts that normally require an authenticated administrator context.

Detection Strategies

Inspect web server access logs for URIs matching the pattern \.php/login_admin\.php and correlate with source IP reputation.
Alert on requests to administrative PHP scripts where the referrer chain lacks a valid prior authentication flow.
Deploy a Web Application Firewall (WAF) rule blocking path segments that append /login_admin.php to any other PHP script.

Monitoring Recommendations

Monitor for anomalous administrative activity such as configuration changes originating from unauthenticated sessions.
Track spikes in PATH_INFO-style URIs targeting the TVox manager interface.
Forward web server and application logs to a centralized analytics platform for correlation with identity and network telemetry.

How to Mitigate CVE-2026-64827

Immediate Actions Required

Restrict network access to the TVox manager HTML directory to trusted administrative networks only.
Deploy WAF rules that reject requests containing /login_admin.php appended to any other PHP script path.
Audit web server logs for prior exploitation attempts against affected TVox deployments.

Patch Information

Upgrade Telenia Software TVox to a version later than 26.5.3 on the 26.x branch or later than 24.9.21 on the 24.x branch once the vendor publishes a fixed release. Consult the Telenia Software Homepage for update availability and the VulnCheck Advisory: Telenia TVOX Bypass for coordinated fix guidance.

Workarounds

Disable PATH_INFO handling in the web server configuration so appended path segments do not resolve to executable scripts.
Front the TVox manager interface with a reverse proxy that normalizes URIs and rejects paths containing multiple .php components.
Enforce IP allow-listing at the network edge until a vendor patch is applied.

bash

# Example Apache configuration to block the exploit pattern
<Location "/manager/html">
    RewriteEngine On
    RewriteCond %{REQUEST_URI} \.php/login_admin\.php [NC]
    RewriteRule .* - [F,L]
</Location>