EIP-2026-112353

The exploit demonstrates an authentication bypass vulnerability in Sourcebans (PHP) by allowing an attacker to change any admin's email address without verification, enabling password reset and full admin access. The vulnerability lies in the `ChangeEmail` function in `sb-callback.php`, which lacks proper ownership checks.