CVE Watch16 de out. de 2026

CVE-2026-108335

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attac

CVSS

—

Sem CVSS

EPSS

0.2%

p15

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-640

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-152026-11-06

Descrição técnica

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

Referências oficiais

knowledge.hitachivantara.comhttps://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=261012131624707&guest=0

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1231968.1 ALT

29.5%

——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2d CVE-2026-114421—

23.0%

——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.3d CVE-2026-1191278.1 ALT

20.3%

——6ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.3d CVE-2026-1162149.1 CRÍ

39.9%

——12MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.3d CVE-2026-943808.1 ALT

25.3%

——8Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.12d CVE-2026-1159737.3 ALT

20.4%

——6A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.9d