CVE-2026-126150
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMai
CVSS
9.1
Crítico
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 11 nov 2026 · Última mod.: 11 nov 2026 · CWE-640
Sin historial EPSS suficiente todavía.
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1187418.1 ALT55.6%
——17Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.14hCVE-2026-600467.5 ALT24.9%
——7An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.1dCVE-2026-1250747.3 ALT22.3%
——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.2dCVE-2026-118459—25.6%
——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.3dCVE-2026-1231968.1 ALT29.8%
——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2dCVE-2026-114421—23.1%
——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.2d