CVE-2026-60046 is a vulnerability allowing an unauthenticated remote attacker to reset passwords for any user if the username and email are known. The attack can be performed without rate limiting, potentially causing a total loss of availability by resetting user passwords.