CVE-2025-63314 describes a critical vulnerability in DDSN Interactive Acora CMS version 10.7.1. The password reset function uses a static token, which enables attackers to reuse the token in a replay attack to reset user passwords arbitrarily. This leads to full account takeover without requiring any privileges or user interaction. The vulnerability is categorized under CWE-640 (Weak Password Recovery Mechanism). There is no information about an available patch or official fix at this time.

Successful exploitation allows an unauthenticated attacker to reset any user's password and gain full control over the account. This compromises confidentiality, integrity, and availability of user accounts within the affected CMS version. The vulnerability has a critical severity rating with a CVSS score of 10, indicating a high likelihood of exploitation and severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality and monitor for suspicious activity related to password resets. Avoid using version 10.7.1 in production environments if possible.