Threats Tagged 'cwe-640'

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-82487 is a medium severity vulnerability in the Beetel 450TC3 device version 01.00.00_01. It involves a weakness in the password recovery mechanism that can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and no patch or fix is currently available. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild.

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress contains a critical vulnerability (CVE-2026-19632) that allows unauthenticated attackers to extract sensitive password-reset URLs. This occurs via the 'trp_get_translations_regular' AJAX action in all versions up to 3.3.1 when automatic string saving is enabled and the administrator's profile locale is set to a published secondary language. The vulnerability exposes the plaintext reset key and login parameters, enabling full administrator account takeover.

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress contains a critical authentication bypass vulnerability in versions up to and including 4.8.6. The vulnerability arises because the handle_email_otp_return() function returns the secret magic login token directly in the response to an OTP request, instead of sending it only to the user's email. This flaw allows unauthenticated attackers who know a user's email address to log in as that user, including administrators.

Dancer2::Plugin::Auth::Extensible versions up to 0.713 for Perl contain a critical vulnerability in their password recovery mechanism. The flaw allows an attacker to poison the password reset link by manipulating the HTTP Host header or X-Forwarded-Host header. This causes the reset email to contain a link pointing to an attacker-controlled host. When a user clicks this link, the attacker gains access to a valid password reset code, enabling account takeover. The vulnerability affects default configurations with reset_password_handler enabled and default message text. Versions 0.711 and earlier read the request URI base directly, while versions 0.712 and later introduce a configuration key that defaults to the untrusted request URI base if unset.

CVE-2026-18963 is a critical vulnerability in the reset-credentials flow of the keycloak-services component in Red Hat build of Keycloak 26.4. This flaw allows an unauthenticated attacker to bypass the required email verification step and directly reset the password of any user, potentially gaining full control over their accounts. The vulnerability affects multiple versions prior to 26.4.15, 26.6.6, and 26.7.2. Red Hat has released security updates to address this issue.

Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.