CWE-640: Weak Password Recovery vulnerabilities

SEPPmail Secure Email Gateway versions before 15.1.1 have a weakness in the password recovery mechanism for created but unregistered GINA accounts with empty initial passwords. An unauthenticated remote attacker who discovers such an account can reset its password without proper ownership verification, gain access, and block the legitimate user from using the account until recovery.

CVE-2026-94380 is a high-severity vulnerability in HAVELSAN Inc. Liman MYS affecting versions from 2.3.4-1124 up to but not including 2.3.5-1131. It involves a weak password recovery mechanism that could be exploited to recover user passwords. The vulnerability has been fixed in version 2.3.5-1131.

OpenReception's appointment booking software versions prior to 2.0.0 contain a vulnerability in the password recovery mechanism where the account-confirmation link in emails is constructed from the request Host header without validation. This allows an attacker to send a specially crafted request with a spoofed Host header, causing a pending invitee to receive a confirmation email with a link pointing to the attacker-controlled domain. If the invitee clicks the link, the attacker obtains the one-time confirmation token and can confirm the account and register a passkey, effectively taking over the account before the legitimate user can use it. The issue is patched in version 2.0.0.

CVE-2026-46347 is a vulnerability in intranda's goobi-viewer-core web application prior to version 26.05. The application generates password reset links with replacement passwords using insufficiently random values, making them predictable. An attacker who can approximate the server-side generation time and who knows the victim triggered a password reset can brute-force the replacement password. This issue is fixed in version 26.05.

CVE-2026-46346 affects the intranda goobi-viewer-core web application prior to version 26.05. The vulnerability involves the use of insufficiently random values for password reset tokens, which are predictably based on the time of the reset request. An attacker who knows a user's email address can request a password reset and brute-force the token to forcibly reset the password without authorization. This issue has been fixed in version 26.05.

Part-DB-server versions prior to 2.13.3 contain a vulnerability in the password recovery mechanism where the password-reset link URL is constructed from an unvalidated client-supplied HTTP Host header. This allows an unauthenticated attacker to craft a reset link with an attacker-controlled hostname, causing the victim to disclose a valid reset token. The attacker can then use this token to reset the victim's password and take over the account, including administrative accounts. This issue is fixed in version 2.13.3.

CVE-2026-16437 is a high-severity vulnerability in multiple Mitsubishi Electric Corporation products including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. The flaw involves a weak password recovery mechanism that allows an authenticated local administrator to tamper with the management file storing the challenge response. This file is protected by Windows, but administrators have read/write access, enabling potential disclosure, tampering, destruction, deletion of internal information, or denial-of-service conditions.

CVE-2026-16436 is a critical vulnerability in multiple Mitsubishi Electric Corporation products including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. The flaw involves a weak password recovery mechanism where the challenge response used to unlock the system is fixed and common to all users. This allows a remote attacker to bypass authentication by obtaining this challenge response, potentially leading to unauthorized disclosure, tampering, destruction, or deletion of internal information, or causing a denial-of-service condition.

CVE-2026-108337 is a vulnerability in Hitachi Vantara Remot Ops Agent versions 1.6.0 through 2.0 that allows an administrator to retrieve password reset codes for any user via an API. These reset codes can be used to take over user accounts. The API is restricted to administrator accounts, so exploitation requires prior administrative access. The vulnerability does not allow access to device credentials or customer data.

CVE-2026-108335 is a critical vulnerability in Hitachi Vantara Remote Ops Agent versions 1.6.0 through 2.0. It involves a weak password recovery mechanism where the password reset functionality lacks rate limiting on reset code attempts. This allows an attacker to brute-force the reset code and take over any account, potentially gaining administrative access to the application. However, device credentials and customer data are not accessible through this vulnerability.

CVE-2026-70175 is a high-severity vulnerability in Microsoft ASP.NET Core 10.0 involving a weak password recovery mechanism that allows improper authentication. This flaw enables an unauthorized attacker to elevate privileges over a network. The issue affects multiple ASP.NET Core versions prior to their respective fixed releases. Official patches have been released to address this vulnerability.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

Joplin Server versions prior to 3.7.2 contain a vulnerability where password reset tokens are not properly verified. An attacker who obtains certain tokens like CSRF or account confirmation tokens through other means can use them to reset a victim's password via the public password-reset endpoint. This can lead to unauthorized password changes and deletion of existing sessions and API applications. The issue is fixed in version 3.7.2.

Kiteworks Core contains a critical vulnerability in its password reset workflow that allows an unauthenticated attacker to reset a user's password without access to the reset email link. This flaw affects versions prior to 9.5.0 and can lead to full account takeover, including accounts with administrative privileges.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress contains a critical vulnerability (CVE-2026-19632) that allows unauthenticated attackers to extract sensitive password-reset URLs. This occurs via the 'trp_get_translations_regular' AJAX action in all versions up to 3.3.1 when automatic string saving is enabled and the administrator's profile locale is set to a published secondary language. The vulnerability exposes the plaintext reset key and login parameters, enabling full administrator account takeover.

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress contains a critical authentication bypass vulnerability in versions up to and including 4.8.6. The vulnerability allows unauthenticated attackers who know a user's email address to log in as that user, including administrators, due to the secret magic login token being returned directly in the OTP request response instead of being sent only to the user's email.

Dancer2::Plugin::Auth::Extensible versions up to 0.713 for Perl contain a critical vulnerability in their password recovery mechanism. The flaw allows an attacker to poison the password reset link by manipulating the HTTP Host header or X-Forwarded-Host header. This causes the reset email to contain a link pointing to an attacker-controlled host. When a user clicks this link, the attacker gains access to a valid password reset code, enabling account takeover. The vulnerability affects default configurations with reset_password_handler enabled and default message text. Versions 0.711 and earlier read the request URI base directly, while versions 0.712 and later introduce a configuration key that defaults to the untrusted request URI base if unset.

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.