CVE-2026-19906

Low

Description

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. This patch is called 529b5df878e571ccc727647f7748eafc1466b041. It is best practice to apply a patch to resolve this issue.

SeverityLow

CVSS3.7

Exploit probability—

ProductPkp-lib

PublishedAug 15, 2026

First seenAug 15, 2026

Weakness typeCWE-331CWE-331 CWE-330CWE-330

How to fix

Patches

github.com/pkp/pkp-lib/commit/529b5df878e571ccc727647f7748eafc1466b041

Affected products

Product	Affected versions	Fixed in
pkp pkp-lib	3.3.0, 3.4.0, 3.5.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.