CVE-2026-12692 is a critical authentication bypass (CVSS 9.8) in Vimesoft Inc. Enterprise Video Platform, from 3.11.0.0 and before 3.25.0. It is an unverified password change flaw that lets someone take over accounts. Upgrade to 3.25.0 or later, and review account activity.
What's affected
From the CVE record:
- Product: Vimesoft Inc. Enterprise Video Platform.
- Affected versions: from 3.11.0.0 before 3.25.0.
- Fixed version: 3.25.0, as the record states that versions before 3.25.0 are affected.
- Weakness class: CWE-620 (unverified password change).
- Effect: authentication bypass.
- Severity: CVSS 9.8, network reachable, no privileges and no user interaction, High impact on all three properties.
- Source of the record: the national cyber security authority of Turkey, in its notice TR-26-0574. We could not retrieve the text of that page for this review, so the details here come from the CVE record.
How to check if you're exposed
- Find every Vimesoft Enterprise Video Platform instance you run. Read the version in the administration interface or from your deployment records.
- Anything from 3.11.0.0 up to but not including 3.25.0 needs the upgrade.
- Check whether the platform is reachable from the internet. Video platforms are often published for staff, partners or customers.
- Review the platform audit logs for password change events, and compare them with password reset requests you know about. Look in particular at administrator accounts.
- Check for new accounts, changed email addresses and new API keys on the platform.
What to do now
- Upgrade to Enterprise Video Platform 3.25.0 or later, following the vendor's upgrade instructions, and test the upgrade first.
- Until you can upgrade, limit access to the platform to a VPN or an allowlist, or place it behind a gateway that requires its own authentication.
- Review password change events and account changes for the period since the platform was upgraded to 3.11.0.0 or later, as far back as your logs go.
- If you find a password change you cannot explain, reset the account, revoke its sessions and API keys, and review what the account could access.
- Turn on multi-factor authentication if the platform supports it, because a changed password does not defeat a second factor.
Why it matters
A password change function has to prove that the person asking is the account owner. Usually that means asking for the current password, or a one time token that was sent to the owner by email. An unverified password change is a function that skips that proof, so anyone who can call it can set a new password for an account and then sign in as that user.
That is why the record calls the result an authentication bypass, and why the score is 9.8: network reachable, no privileges and no user interaction. We do not have the vendor's technical write-up, so we do not describe how the proof was missing. The defensive points are plain. Upgrade, reduce exposure, and look at the audit trail for password changes you did not expect.
An account takeover on a video platform can expose recorded meetings, training content and internal announcements, and an administrator account can change who sees what. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the record does not claim exploitation.
Quick check
Which versions are affected?
From 3.11.0.0 before 3.25.0, per the record.
Where does the record come from?
The record cites the Turkish national cyber security authority, notice TR-26-0574. We could not retrieve the page text, so check it directly for any additional guidance.
Sources
- Gold entry and CVE record: CVE-2026-12692.
- Reference listed in the record, not retrievable for this review: Turkish national cyber security notice TR-26-0574.
Last reviewed: 19 October 2026.
