CVE-2026-128331
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-620
Sin historial EPSS suficiente todavía.
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
- github.comhttps://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128
- github.comhttps://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98
- github.comhttps://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1
- github.comhttps://github.com/miniflux/v2/pull/4596
- github.comhttps://github.com/miniflux/v2/releases/tag/v2.3.5
- github.comhttps://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8
- www.vulncheck.comhttps://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1270584.9 MED—
——0WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.6hCVE-2025-714579.8 CRÍ39.0%
——12vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.1dCVE-2026-1194294.3 MED35.0%
——10phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.10dCVE-2026-1189845.5 MED32.6%
——10OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.16dCVE-2013-200086.8 MED16.8%
——5Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.11dCVE-2026-1120026.8 MED21.8%
——7ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.25d