This vulnerability (CVE-2026-6285) concerns a weak password recovery mechanism in LIBRID/LIBREF version 2.01.0.2183 by Ankaref Innovation and Technology Inc. The weakness allows exploitation of the password recovery process, potentially enabling unauthorized access. The CVSS 3.1 base score is 7.5, indicating high severity, with an attack vector over the network, no privileges required, no user interaction, and impact on confidentiality but not integrity or availability. The vendor has not issued any patch or remediation, and no known exploits are currently reported in the wild.

Successful exploitation could lead to unauthorized disclosure of sensitive information by bypassing or exploiting the password recovery mechanism. The vulnerability impacts confidentiality but does not affect integrity or availability. This could allow attackers to gain access to accounts without proper authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should monitor for updates from Ankaref Innovation and Technology Inc. and consider implementing compensating controls around password recovery processes until a fix is available.