Weak Password Recovery Mechanism for Forgotten Password
CWE-640
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We track 178 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Latest Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 8.1 High severity
Control Web Panel: Weak Password Recovery Mechanism for Forgotten Password
Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token gen
- 8.1 High severity
mrbs-code: Weak Password Recovery Mechanism for Forgotten Password
MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a l
- 8.1 High severity
2FAuth: Weak Password Recovery Mechanism for Forgotten Password
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, captur
- 7.5 High severity
Hyper E-Commerce Infrastructure: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce I
- 9.1 Critical severity
FortiMail: Weak Password Recovery Mechanism for Forgotten Password
A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an a
- 7.5 High severity
mbCONNECT24: Weak Password Recovery Mechanism for Forgotten Password
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
- 7.3 High severity
Smart Attendance System with QR Code Scanner: Weak Password Recovery Mechanism for Forgotten Password
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password
- 8.1 High severity
authorizer: Weak Password Recovery Mechanism for Forgotten Password
Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Au
- 8.3 High severity
SEPPmail Secure Email Gateway (SEG): Weak Password Recovery Mechanism for Forgotten Password
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a
- 8.1 High severity
zitadel: Weak Password Recovery Mechanism for Forgotten Password
ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-h
- 9.1 Critical severity
maccms10: Weak Password Recovery Mechanism for Forgotten Password
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user
- 8.1 High severity
Liman MYS: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
- 7.3 High severity
Faveo Helpdesk: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulatio
- 8.3 High severity
appointment-booking-software: Weak Password Recovery Mechanism for Forgotten Password
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/
- 8.7 High severity
Part-DB-server: Weak Password Recovery Mechanism for Forgotten Password
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation.
- 7.1 High severity
GENESIS: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX
- 9.2 Critical severity
GENESIS: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX
- 7.4 High severity
Remot Ops Agent: Weak Password Recovery Mechanism for Forgotten Password
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator ac
- 9.1 Critical severity
Remote Ops Agent: Weak Password Recovery Mechanism for Forgotten Password
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force soluti
- 7.4 High severity
Agora Project: Weak Password Recovery Mechanism for Forgotten Password
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attacker
- 7.4 High severity
Portal del Hermano (portaldelhermano.es): Improper Restriction of Excessive Authentication Attempts
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take
- 9.1 Critical severity
Enswitch: Weak Password Recovery Mechanism for Forgotten Password
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pend
- 9.1 Critical severity
MyRezzta: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.
- 9.1 Critical severity
GetSimpleCMS-CE: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the ap
- 9.8 Critical severity
Core: Weak Password Recovery Mechanism for Forgotten Password
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to th
- 8.3 High severity
POWER13: Weak Password Recovery Mechanism for Forgotten Password
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has b
- 8.8 High severity
Sylius: Weak Password Recovery Mechanism for Forgotten Password
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers
- 8.3 High severity
SOGo: Weak Password Recovery Mechanism for Forgotten Password
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a
- 8.8 High severity
MobiAPParc: Weak Password Recovery Mechanism for Forgotten Password
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving accoun
- 7.3 High severity
Tourism-Management-System: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak pas
- 7.5 High severity
LIBRID/LIBREF: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.
- 9.1 Critical severity
Team Password Manager: Weak Password Recovery Mechanism for Forgotten Password
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.
- 7.5 High severity
kimai: Weak Password Recovery Mechanism for Forgotten Password
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset
- 9.8 Critical severity
TranslatePress – Translate Multilingual sites…: Weak Password Recovery Mechanism for Forgotten Password
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible fo
- 9.8 Critical severity
Automation Web Platform – Notifications and…: Weak Password Recovery Mechanism for Forgotten Password
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() function returning the
- 9.1 Critical severity
Red Hat build of Keycloak 26.4: Weak Password Recovery Mechanism for Forgotten Password
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for an
- 9.8 Critical severity
Dancer2::Plugin::Auth::Extensible: Weak Password Recovery Mechanism for Forgotten Password
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Both default emails emit a link of the form `$base/login/$code`, whose
- 9.8 Critical severity
Wishlist Member: Weak Password Recovery Mechanism for Forgotten Password
The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the
- 8.1 High severity
budibase: Weak Password Recovery Mechanism for Forgotten Password
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is
- 8.8 High severity
n8n: Weak Password Recovery Mechanism for Forgotten Password
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was veri