This vulnerability, identified as CWE-640, concerns a weak password recovery mechanism in Nokri versions up to 1.6.6. The issue is an unauthenticated broken access control that enables attackers to exploit the password recovery process without proper authorization. The CVSS 3.1 score of 9.8 indicates a critical severity with network attack vector, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of user accounts through the password recovery process, resulting in unauthorized access and control over the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level, potentially allowing attackers to manipulate or disrupt the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password recovery functionality if possible and monitor for suspicious activity related to account recovery attempts.