# CWE-640.

Every Advisory and CVE whose sources give the weakness CWE-640, newest first.

## Records, newest first

- [Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata](https://agentprime.io/advisories/CVE-2026-123196.md)
  `CVE-2026-123196` · CVE record: authorizerdev authorizer · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-640
- [Empty initial password permits GINA account takeover](https://agentprime.io/advisories/CVE-2026-114421.md)
  `CVE-2026-114421` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 8.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-640
- [ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection](https://agentprime.io/advisories/CVE-2026-119127.md)
  `CVE-2026-119127` · CVE record: zitadel zitadel · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-640
- [MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code](https://agentprime.io/advisories/CVE-2026-116214.md)
  `CVE-2026-116214` · CVE record: maccmspro maccms10 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-640
- [Host Header Injection in HAVELSAN's Liman MYS](https://agentprime.io/advisories/CVE-2026-94380.md)
  `CVE-2026-94380` · CVE record: HAVELSAN Inc. Liman MYS · CVSS 8.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-640
- [FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery](https://agentprime.io/advisories/CVE-2026-115973.md)
  `CVE-2026-115973` · CVE record: FaveoSuite Faveo Helpdesk · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: CWE-640
- [OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via \`POST /api/auth/resend-confirmation\`](https://agentprime.io/advisories/CVE-2026-58202.md)
  `CVE-2026-58202` · CVE record: open-reception appointment-booking-software · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-640
- [Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset](https://agentprime.io/advisories/CVE-2026-46347.md)
  `CVE-2026-46347` · CVE record: intranda goobi-viewer-core · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset](https://agentprime.io/advisories/CVE-2026-46346.md)
  `CVE-2026-46346` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-340, CWE-640
- [Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover](https://agentprime.io/advisories/CVE-2026-86055.md)
  `CVE-2026-86055` · CVE record: Part-DB Part-DB-server · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-640
- [Weak password recovery in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43845.md)
  `CVE-2026-43845` · CVE record: Advantech ADAM-3600 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-640
- [aircheng-org iWebShop-5 simple.php send_message_mobile password recovery](https://agentprime.io/advisories/CVE-2026-112035.md)
  `CVE-2026-112035` · CVE record: aircheng-org iWebShop-5 · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-640
- [An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz](https://agentprime.io/advisories/CVE-2026-16437.md)
  `CVE-2026-16437` · CVE record: Mitsubishi Electric Corporation GENESIS and 4 more · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-640
- [An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz](https://agentprime.io/advisories/CVE-2026-16436.md)
  `CVE-2026-16436` · CVE record: Mitsubishi Electric Corporation GENESIS and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-640
- [Password Reset Code Accessible in User Listing API](https://agentprime.io/advisories/CVE-2026-108337.md)
  `CVE-2026-108337` · CVE record: Hitachi Vantara Remot Ops Agent · CVSS 7.4 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-640
- [Password Reset Functionality Missing Brute-Force Protection](https://agentprime.io/advisories/CVE-2026-108335.md)
  `CVE-2026-108335` · CVE record: Hitachi Vantara Remote Ops Agent · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-640
- [Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover](https://agentprime.io/advisories/CVE-2026-63159.md)
  `CVE-2026-63159` · CVE record: Omnispace Agora Project · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-640
- [Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-x3vp-85cm-q97r.md)
  `GHSA-x3vp-85cm-q97r`, `CVE-2026-70175` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13`, fixed in `8.0.32`, `9.0.21`, `10.0.13` · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-640
- [Netherman Portal del Hermano Account Takeover via Password Reset Oracle](https://agentprime.io/advisories/CVE-2026-53997.md)
  `CVE-2026-53997` · CVE record: NetHerman Portal del Hermano (portaldelhermano.es) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass, CWE-640
- [LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket](https://agentprime.io/advisories/CVE-2026-109204.md)
  `CVE-2026-109204` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-640
- [Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion](https://agentprime.io/advisories/CVE-2026-108737.md)
  `CVE-2026-108737` · CVE record: Traccar Traccar · CVSS 7.6 High · Not analysed yet · Published 11 Oct 2026 · Tags: CWE-640
- [Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API](https://agentprime.io/advisories/CVE-2026-107640.md)
  `CVE-2026-107640` · CVE record: Integrics Enswitch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-640
- [Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta](https://agentprime.io/advisories/CVE-2026-19218.md)
  `CVE-2026-19218` · CVE record: AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-640
- [Joplin Server password reset accepts tokens issued for unrelated purposes](https://agentprime.io/advisories/CVE-2026-105785.md)
  `CVE-2026-105785` · CVE record: laurent22 joplin · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-620, CWE-640
- [GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover](https://agentprime.io/advisories/CVE-2026-53953.md)
  `CVE-2026-53953` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS, CWE-640
- [Kiteworks Core Authentication Bypass in the Password Reset Workflow](https://agentprime.io/advisories/CVE-2026-102115.md)
  `CVE-2026-102115` · CVE record: Kiteworks Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-640
- [Netcore POWER13 ubus routerd.passwd_set password recovery](https://agentprime.io/advisories/CVE-2026-101188.md)
  `CVE-2026-101188` · CVE record: Netcore POWER13 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-640
- [Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint](https://agentprime.io/advisories/CVE-2026-93340.md)
  `CVE-2026-93340` · CVE record: Gladys Assistant Gladys Assistant · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-640
- [SOGo before 5.12.11 Password Reset Token Interception via Origin Header](https://agentprime.io/advisories/CVE-2026-93453.md)
  `CVE-2026-93453` · CVE record: Alinto SOGo · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-640
- [Weak password recovery mechanism for forgotten password in MobiAPParc](https://agentprime.io/advisories/CVE-2026-14850.md)
  `CVE-2026-14850` · CVE record: MobiAPParc MobiAPParc · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-640
- [jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery](https://agentprime.io/advisories/CVE-2026-90522.md)
  `CVE-2026-90522` · CVE record: jaychouchannel Tourism-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-640
- [Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.](https://agentprime.io/advisories/CVE-2026-81905.md)
  `CVE-2026-81905` · CVE record: Concrete CMS Concrete CMS · CVSS 6.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control, CWE-640
- [Improper Authentication in Ankaref's LIBRID/LIBREF](https://agentprime.io/advisories/CVE-2026-6285.md)
  `CVE-2026-6285` · CVE record: Ankaref Innovation and Technology Inc. LIBRID/LIBREF · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-640
- [sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change](https://agentprime.io/advisories/CVE-2026-86260.md)
  `CVE-2026-86260` · CVE record: sfturing hosp_order · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-620, CWE-640
- [An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component](https://agentprime.io/advisories/CVE-2026-71625.md)
  `CVE-2026-71625` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation, CWE-640
- [CVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token theft](https://agentprime.io/advisories/GHSA-77w3-2367-7xvq.md)
  `GHSA-77w3-2367-7xvq`, `CVE-2026-100870`, `PKSA-bqq7-pykv-vwcc` · Packagist `sylius/sylius`: affected `>=1.12.0, <1.12.25 || >=1.13.0, <1.13.17 || >=1.14.0, <1.14.20 || >=2.0.0, <2.1.0 || >=2.1.0, <2.1.16 || >=2.2.0, <2.2.9`, fixed in `1.12.25`, `1.13.17`, `1.14.20`, `2.1.0`, `2.1.16`, `2.2.9` · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-640
- [Team Password Manager before 14.184.308 Authentication Bypass in Password Reset](https://agentprime.io/advisories/CVE-2026-84699.md)
  `CVE-2026-84699` · CVE record: Team Password Manager Team Password Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-640
- [Beetel 450TC3 password recovery](https://agentprime.io/advisories/CVE-2026-82487.md)
  `CVE-2026-82487` · CVE record: Beetel 450TC3 · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-640
- [Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass](https://agentprime.io/advisories/GHSA-h854-c3m3-mh5v.md)
  `GHSA-h854-c3m3-mh5v`, `CVE-2026-55207`, `PKSA-spw3-r32w-35m6` · Packagist `pimcore/studio-backend-bundle`: affected `<2025.4.6 || >=2026.1.0, <2026.1.6`, fixed in `2025.4.6`, `2026.1.6` · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-640
- [TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure](https://agentprime.io/advisories/CVE-2026-19632.md)
  `CVE-2026-19632` · CVE record: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-640
- [Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure](https://agentprime.io/advisories/CVE-2026-77264.md)
  `CVE-2026-77264` · CVE record: 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-640
- [Keycloak: Unauthenticated account takeover via reset-credentials flow bypass](https://agentprime.io/advisories/GHSA-4gv3-mc9p-5wqc.md)
  `GHSA-4gv3-mc9p-5wqc`, `BIT-keycloak-2026-18963`, `CVE-2026-18963` · Maven `org.keycloak:keycloak-services`: affected `>=26.0.0, <26.4.15 || >=26.5.0, <26.6.6 || >=26.7.0, <26.7.2`, fixed in `26.4.15`, `26.6.6`, `26.7.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-640
- [Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in \_default_email_password_reset and \_default_welcome_send](https://agentprime.io/advisories/CVE-2026-15689.md)
  `CVE-2026-15689` · CVE record: ABEVERLEY Dancer2::Plugin::Auth::Extensible · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-640
- [Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter](https://agentprime.io/advisories/CVE-2026-12949.md)
  `CVE-2026-12949` · CVE record: Wishlist Member Wishlist Member · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-640
- [Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email](https://agentprime.io/advisories/CVE-2026-72856.md)
  `CVE-2026-72856` · CVE record: Budibase budibase · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-640
- [WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-66691.md)
  `CVE-2026-66691` · CVE record: scriptsbundle Nokri · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-640
- [WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-61967.md)
  `CVE-2026-61967` · CVE record: miniOrange miniorange otp verification · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-640
- [Authentication Bypass Leading to Account Takeover](https://agentprime.io/advisories/CVE-2026-12571.md)
  `CVE-2026-12571` · CVE record: zohocorp manageengine_ddi_central · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Authentication bypass, CWE-640
- [macrozheng mall mall-portal getAuthCode password recovery](https://agentprime.io/advisories/CVE-2026-19361.md)
  `CVE-2026-19361` · CVE record: macrozheng mall · CVSS 6.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: CWE-640
- [TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'](https://agentprime.io/advisories/CVE-2026-14364.md)
  `CVE-2026-14364` · CVE record: themetechmount TrueBooker – Appointment Booking and Scheduler System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-640
- [Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover](https://agentprime.io/advisories/CVE-2026-9273.md)
  `CVE-2026-9273` · CVE record: stellarwp Membership Plugin – Kadence Memberships · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-640
- [Weak password recovery mechanism in osTicket by Enhancesoft LLC](https://agentprime.io/advisories/CVE-2026-18363.md)
  `CVE-2026-18363` · CVE record: Enhancesoft LLC osTicket · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-640
- [Weak password recovery in Veeam Service Provider Console](https://agentprime.io/advisories/CVE-2026-64635.md)
  `CVE-2026-64635` · CVE record: Veeam Service Provider Console · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-640
- [n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login](https://agentprime.io/advisories/GHSA-8342-988q-86cr.md)
  `GHSA-8342-988q-86cr`, `CVE-2026-72772` · npm `n8n`: affected `<2.31.5 || >=2.32.0, <2.32.1`, fixed in `2.31.5`, `2.32.1` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control, CWE-345, CWE-640
- [Open redirect in Oracle Corporation Oracle Production Scheduling](https://agentprime.io/advisories/CVE-2026-62517.md)
  `CVE-2026-62517` · CVE record: Oracle Corporation Oracle Production Scheduling · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Open redirect, CWE-345, CWE-640
- [Weak password recovery in Oracle Corporation Oracle Contracts Integration](https://agentprime.io/advisories/CVE-2026-62486.md)
  `CVE-2026-62486` · CVE record: Oracle Corporation Oracle Contracts Integration · CVSS 5.0 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-640
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-61181.md)
  `CVE-2026-61181` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 7.6 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Open redirect, CWE-640
- [Improper access control in Oracle Corporation Oracle Communications Convergent Charging Controller](https://agentprime.io/advisories/CVE-2026-61143.md)
  `CVE-2026-61143` · CVE record: Oracle Corporation Oracle Communications Convergent Charging Controller · CVSS 6.4 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Authentication bypass, Open redirect, CWE-640
- [Improper access control in Oracle Corporation Oracle Production Scheduling](https://agentprime.io/advisories/CVE-2026-61049.md)
  `CVE-2026-61049` · CVE record: Oracle Corporation Oracle Production Scheduling · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, Authentication bypass, CWE-640
- [Open redirect in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-60658.md)
  `CVE-2026-60658` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site request forgery (CSRF), Open redirect, CWE-451, CWE-640

Older: <https://agentprime.io/advisories/tag/cwe-640.md?cursor=WyIyMDI2LTA3LTIxVDIxOjM2OjI1LjIwMTAwMFoiLCJDVkUtMjAyNi02MDY1OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-640>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-640/>. Everything for agents: <https://agentprime.io/llms.txt>.