CVE-2026-53904 describes a vulnerability in MyComplianceOffice (MCO) version 25.3.3.1 where the password reset process lacks proper rate limiting or restrictions on the number of resets. Each reset invalidates the victim's current password and any temporary passwords, allowing an attacker who can provide the victim's email and correctly answer their security question to repeatedly reset the password and deny the victim access. The security question mechanism limits the number of attempts, mitigating but not fully preventing exploitation. No vendor response or patch is currently documented.

An attacker can cause an account denial of service by continuously resetting the victim's password, locking the legitimate user out of their account. This disrupts normal user access but does not directly indicate data compromise or privilege escalation. The vulnerability relies on the attacker knowing the victim's email and correctly answering their security question.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should monitor for suspicious password reset activity and consider additional controls around password reset processes. The limited number of attempts for answering security questions reduces risk but does not fully mitigate the vulnerability.