Weak Password Recovery Mechanism for Forgotten Password
CWE-640
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We track 178 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Latest Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Weak Password Recovery Mechanism for Forgotten Password
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's iden
- 9.3 Critical severity
Membership Plugin – Kadence Memberships: Weak Password Recovery Mechanism for Forgotten Password
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler
- 9.1 Critical severity
osTicket: Weak Password Recovery Mechanism for Forgotten Password
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whet
- 7.6 High severity
Oracle Agile Product Lifecycle Management for…: Improper Access Control
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker
- 7.1 High severity
Oracle Production Scheduling: Improper Access Control
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to th
- 7.5 High severity
Oracle WebCenter Content: Cross-Site Request Forgery
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network a
- 8.0 High severity
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with netw
- 8.0 High severity
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with netw
- 8.0 High severity
Oracle WebCenter Content: Improper Neutralization of Input During Web Page Generation
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with netw
- 9.4 Critical severity
freescout: Improper Handling of Case Sensitivity
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash`
- 7.3 High severity
Capgo: Weak Password Recovery Mechanism for Forgotten Password
Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change the account email to ga
- 7.3 High severity
NX15: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak p
- 8.8 High severity
Essential Addons for Elementor – Popular…: Weak Password Recovery Mechanism for Forgotten Password
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side vali
- 8.1 High severity
SureCart – Ecommerce Made Easy For Selling…: Weak Password Recovery Mechanism for Forgotten Password
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer
- 8.8 High severity
pimcore: Weak Password Recovery Mechanism for Forgotten Password
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlle
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcG
- 9.8 Critical severity
Portal for ArcGIS: Weak Password Recovery Mechanism for Forgotten Password
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be a
- 7.7 High severity
FOSSBilling: Weak Password Recovery Mechanism for Forgotten Password
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest
- 7.1 High severity
MCO: Improper Restriction of Excessive Authentication Attempts
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are no
- 9.8 Critical severity
SignUp & SignIn: Weak Password Recovery Mechanism for Forgotten Password
The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via
- 9.8 Critical severity
Invoice Generator: Weak Password Recovery Mechanism for Forgotten Password
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce
- 9.8 Critical severity
Branda – White Label & Branding, Free Login…: Weak Password Recovery Mechanism for Forgotten Password
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possibl
- 9.1 Critical severity
capgo: Weak Password Recovery Mechanism for Forgotten Password
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacke
- 8.0 High severity
Oracle iSupplier Portal: Cross-Site Request Forgery
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to co
- 8.1 High severity
ApostropheCMS is an open-source Node.js content management system.
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when
- 7.3 High severity
PbootCMS: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/che
- 8.8 High severity
LimeSurvey: Weak Password Recovery Mechanism for Forgotten Password
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::chec
- 7.5 High severity
Simple History – Track, Log, and Audit…: Weak Password Recovery Mechanism for Forgotten Password
The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unreact_to_event()
- 8.2 High severity
phpMyFAQ: Weak Password Recovery Mechanism for Forgotten Password
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force
- 8.8 High severity
AzuraCast: Weak Password Recovery Mechanism for Forgotten Password
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can
- 8.1 High severity
phpBB: Weak Password Recovery Mechanism for Forgotten Password
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL.
- 8.1 High severity
M60: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is n
- 7.4 High severity
blueprintue-self-hosted-edition: Weak Password Recovery Mechanism for Forgotten Password
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmail
- 9.8 Critical severity
openaev: Weak Password Recovery Mechanism for Forgotten Password
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0.0 and prior to version 2.0.13, OpenAEV's password reset implementation contains multiple security wea
- 7.1 High severity
Fuel CMS: Weak Password Recovery Mechanism for Forgotten Password
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- 9.8 Critical severity
chamilo-lms: Weak Password Recovery Mechanism for Forgotten Password
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compu
- 9.1 Critical severity
payload: External Control of Assumed-Immutable Web Parameter
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who i
- 9.8 Critical severity
eComplaint: Exposure of Sensitive Information to an Unauthorized Actor
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password a
- 7.2 High severity
studiocms: Authorization Bypass Through User-Controlled Key
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any o
- 9.4 Critical severity
Account Management Portal: Weak Password Recovery Mechanism for Forgotten Password
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-