Threats tagged 'ghsa-v286-fq46-38fw'

vtenext versions before 25.02.1 contain an authentication bypass vulnerability that allows unauthenticated attackers to change any account password without token verification. By exploiting the hub/rpwd.php endpoint with a known valid user_name, attackers can invoke a password change action and gain administrator access if two-factor authentication is not enabled.