CVE-2026-127088
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging t
CVSS
8.1
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-640
Sin historial EPSS suficiente todavía.
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
- github.comhttps://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47
- github.comhttps://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64
- github.comhttps://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3
- github.comhttps://github.com/Bubka/2FAuth/releases/tag/v9.0.1
- github.comhttps://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv
- www.vulncheck.comhttps://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1240208.1 ALT—
———Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.4hCVE-2026-1291348.1 ALT—
———MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing the reset key when opened to take over accounts including administrators.9hCVE-2026-1254325.3 MED—
———Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.9hCVE-2026-1109517.5 ALT—
——0Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.
This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.1dCVE-2026-1261509.1 CRÍ43.7%
——13A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests.1dCVE-2026-1187418.1 ALT55.7%
——17Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.7h