CVE-2021-32648VulnerabilityPublished 01/18/2022Updated 10/24/2026

CVE-2021-32648: October CMS Improper Authentication

Affects October CMS October CMSSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/18/2022
KEV deadline: 02/01/2022
EPSS: 90.4% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-32648 (opens in a new tab)

Description

CVE-2021-32648 is an improper authentication vulnerability in affected versions of the october/system package of October CMS. An attacker can request a password reset and then use a specially crafted request to gain unauthorized access to the targeted account. This vulnerability has been exploited in the wild.

Summary

This vulnerability in October CMS's october/system package allows an attacker to bypass authentication by requesting a password reset and then leveraging a specially crafted request to access the account without proper authorization. The flaw relates to improper authentication controls (CWE-287). Exploitation has been observed in the wild, indicating active threat use.

Impact

Successful exploitation results in unauthorized account access, potentially allowing attackers to take over user accounts within October CMS installations. This can lead to further compromise of the affected system depending on the privileges of the compromised account.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and apply any official fixes once available.

Weaknesses

CWE-287Improper Authentication (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:57:24 UTC

Weaknesses

References

Related threats