CVE Watch16 de out. de 2026

CVE-2026-108337

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in

CVSS

—

Sem CVSS

EPSS

0.3%

p21

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-640

EPSS · 30d

0.3%EPSS · 30 dias0.3%

2026-10-152026-11-06

Descrição técnica

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

Referências oficiais

knowledge.hitachivantara.comhttps://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=261012131624707&guest=0

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1231968.1 ALT

29.5%

——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2d CVE-2026-114421—

23.0%

——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.3d CVE-2026-1191278.1 ALT

20.3%

——6ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.3d CVE-2026-1162149.1 CRÍ

39.9%

——12MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.3d CVE-2026-943808.1 ALT

25.3%

——8Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.12d CVE-2026-1159737.3 ALT

20.4%

——6A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.9d