CVE-2026-106602: Authentication Bypass Using an Alternate Path or Channel in Automattic Jetpack

This vulnerability in Automattic Jetpack enables an attacker to bypass authentication by using an alternate path or channel, specifically targeting the password recovery functionality. The issue affects all Jetpack versions prior to 16.3. The CVSS 3.1 vector indicates a network attack vector with high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with low severity, but no impact on availability.

An attacker could exploit this vulnerability to bypass authentication and potentially manipulate password recovery, leading to limited confidentiality and integrity impacts. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Automattic's advisories for updates and apply any forthcoming patches promptly.