CVE-2026-108048 is a vulnerability in Alosuite's password recovery functionality where the '/Account/resetPwd' endpoint lacks adequate request limits. This allows a remote attacker to trigger an unlimited number of password reset emails for a single user, potentially causing email flooding and abuse of the password recovery mechanism. The flaw can negatively impact legitimate users and strain application and email infrastructure resources.