CWE-640.

Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata

• authorizer
• CWE-640

Empty initial password permits GINA account takeover

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• CWE-640

ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

• zitadel
• CWE-640

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

• maccmspro maccms10
• magicblack maccms10
• CWE-640

Host Header Injection in HAVELSAN's Liman MYS

• HAVELSAN Inc. Liman MYS
• CWE-640

FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

• FaveoSuite Faveo Helpdesk
• CWE-640

OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

• open-reception appointment-booking-software
• CWE-640

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

• intranda goobi-viewer-core
• Weak cryptography or TLS
• CWE-340

Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

• Part-DB-server
• CWE-640

Weak password recovery in Advantech ADAM-3600

• Advantech ADAM-3600
• CWE-640

aircheng-org iWebShop-5 simple.php send_message_mobile password recovery

• aircheng-org iWebShop-5
• CWE-640

An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

• Mitsubishi Electric Corporation GENESIS
• Mitsubishi Electric Iconics Digital Solutions GENESIS
• CWE-640

An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

• Mitsubishi Electric Corporation GENESIS
• Mitsubishi Electric Iconics Digital Solutions GENESIS
• CWE-640

Password Reset Code Accessible in User Listing API

• Hitachi Vantara Remot Ops Agent
• CWE-640

Password Reset Functionality Missing Brute-Force Protection

• Hitachi Vantara Remote Ops Agent
• CWE-640

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

• Omnispace Agora Project
• CWE-640

Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

• CWE-640

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 · fixed in 8.0.32, 9.0.21, 10.0.13

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

• NetHerman Portal del Hermano (portaldelhermano.es)
• Authentication bypass
• CWE-640

LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket

• LogicalDOC Community Edition
• CWE-640

Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

• Traccar
• CWE-640

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

• Integrics Enswitch
• CWE-640

Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta

• AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta
• CWE-640

Joplin Server password reset accepts tokens issued for unrelated purposes

• laurent22 joplin
• CWE-620
• CWE-640

GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

• GetSimpleCMS-CE
• Weak cryptography or TLS
• CWE-640

Kiteworks Core Authentication Bypass in the Password Reset Workflow

• Kiteworks Core
• CWE-640

Netcore POWER13 ubus routerd.passwd_set password recovery

• Netcore POWER13
• CWE-640

Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

• Gladys Assistant
• CWE-640

SOGo before 5.12.11 Password Reset Token Interception via Origin Header

• Alinto SOGo
• CWE-640

Weak password recovery mechanism for forgotten password in MobiAPParc

• MobiAPParc
• CWE-640

jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

• jaychouchannel Tourism-Management-System
• CWE-640

Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

• Concrete CMS
• Broken access control
• CWE-640

Improper Authentication in Ankaref's LIBRID/LIBREF

• Ankaref Innovation and Technology Inc. LIBRID/LIBREF
• CWE-640

sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change

• sfturing hosp_order
• CWE-620
• CWE-640

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

• Privilege escalation
• CWE-640

CVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token theft

• CWE-640

>=1.12.0, <1.12.25 || >=1.13.0, <1.13.17 || >=1.14.0, <1.14.20 || >=2.0.0, <2.1.0 || >=2.1.0, <2.1.16 || >=2.2.0, <2.2.9 · fixed in 1.12.25, 1.13.17, 1.14.20, 2.1.0, 2.1.16, 2.2.9

Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

• Team Password Manager
• CWE-640

Beetel 450TC3 password recovery

• Beetel 450TC3
• CWE-640

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

• CWE-640

<2025.4.6 || >=2026.1.0, <2026.1.6 · fixed in 2025.4.6, 2026.1.6

TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

• cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
• CWE-640

Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

• 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
• CWE-640

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

• CWE-640

>=26.0.0, <26.4.15 || >=26.5.0, <26.6.6 || >=26.7.0, <26.7.2 · fixed in 26.4.15, 26.6.6, 26.7.2

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

• ABEVERLEY Dancer2::Plugin::Auth::Extensible
• CWE-640

Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

• Wishlist Member
• CWE-640

Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

• budibase
• CWE-640

WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

• scriptsbundle Nokri
• CWE-640

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

• miniorange otp verification
• CWE-640

Authentication Bypass Leading to Account Takeover

• zohocorp manageengine_ddi_central
• Authentication bypass
• CWE-640

macrozheng mall mall-portal getAuthCode password recovery

• macrozheng mall
• CWE-640

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'

• themetechmount TrueBooker – Appointment Booking and Scheduler System
• CWE-640

Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover

• stellarwp Membership Plugin – Kadence Memberships
• CWE-640

Weak password recovery mechanism in osTicket by Enhancesoft LLC

• Enhancesoft LLC osTicket
• CWE-640

Weak password recovery in Veeam Service Provider Console

• Veeam Service Provider Console
• CWE-640

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

• Broken access control
• CWE-345

<2.31.5 || >=2.32.0, <2.32.1 · fixed in 2.31.5, 2.32.1

Open redirect in Oracle Corporation Oracle Production Scheduling

• Oracle Corporation Oracle Production Scheduling
• Open redirect
• CWE-345

Weak password recovery in Oracle Corporation Oracle Contracts Integration

• Oracle Corporation Oracle Contracts Integration
• Broken access control
• CWE-640

Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process

• Oracle Corporation Oracle Agile Product Lifecycle Management for Process
• Broken access control
• Open redirect

Improper access control in Oracle Corporation Oracle Communications Convergent Charging Controller

• Oracle Corporation Oracle Communications Convergent Charging Controller
• Broken access control
• Authentication bypass

Improper access control in Oracle Corporation Oracle Production Scheduling

• Oracle Corporation Oracle Production Scheduling
• Broken access control
• Authentication bypass

Open redirect in Oracle Corporation Oracle WebCenter Content

• Oracle Corporation Oracle WebCenter Content
• Cross-site request forgery (CSRF)
• Open redirect