A vulnerability in Ente's 2of3 card format version 1 allowed for offline recovery of low-entropy or predictable secrets due to the cleartext storage of secret byte length and 32-bit FNV-1a checksum. This issue was fixed in version 2026.07.28. The vulnerability posed a medium-priority risk, allowing defenders to assess exposure and verify remediation to prevent potential offline attacks on low-entropy or p [truncated]
CVE-2026-16751 is an authorization bypass vulnerability in the emergency recovery approval component of Ente Technologies Ente Museum Server. An authenticated attacker configured as a victim's emergency contact can bypass the recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request. This vulnerability allows attackers to potentially take over accounts without [truncated]
