Weak Password Recovery Mechanism for Forgotten Password
CWE-640
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We track 178 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Latest Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 8.1 High severity
irrd: URL Redirection to Untrusted Site
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a pas
- 9.8 Critical severity
vikunja: Weak Password Recovery Mechanism for Forgotten Password
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to i
- 9.8 Critical severity
evershop: Weak Password Recovery Mechanism for Forgotten Password
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take o
- 8.8 High severity
cms: Weak Password Recovery Mechanism for Forgotten Password
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker m
- 8.1 High severity
funadmin: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remo
- 8.1 High severity
VIP 3260 Z IA: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remote
- 9.8 Critical severity
known: Exposure of Sensitive Information to an Unauthorized Actor
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any
- 9.8 Critical severity
mall: Weak Password Recovery Mechanism for Forgotten Password
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password r
- 10.0 Critical severity
Sufirmam: Authentication Bypass by Primary Weakness
Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation. This issue affects Sufirmam
- 9.4 Critical severity
Sufirmam: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Brute Force, Password Recovery Exploitation. This issue affects Su
- 9.8 Critical severity
Operation and Maintenance Security Management…: Weak Password Recovery Mechanism for Forgotten Password
A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password reco
- 9.8 Critical severity
Beehive Forum: Weak Password Recovery Mechanism for Forgotten Password
Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can inject a malicious host header to intercept password reset tokens and change vict
- 10.0 Critical severity
Cm3 Acora CMS: Weak Password Recovery Mechanism for Forgotten Password
A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.
- 8.1 High severity
badaso: Weak Password Recovery Mechanism for Forgotten Password
A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack
- 7.5 High severity
LDAP Tool Box Self Service Password: Weak Password Recovery Mechanism for Forgotten Password
LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled ser
- 7.1 High severity
Keepassxc-browser: Cross-Site Request Forgery
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to access populated form f
- 9.8 Critical severity
security: Weak Password Recovery Mechanism for Forgotten Password
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need
- 8.8 High severity
MasaCMS: Origin Validation Error
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- 8.8 High severity
orangehrm: Weak Password Recovery Mechanism for Forgotten Password
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally ini
- 9.8 Critical severity
Imonnit: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.
- 9.1 Critical severity
Inventory Management System: Weak Password Recovery Mechanism for Forgotten Password
A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from
- 8.8 High severity
clipbucket-v5: Weak Password Recovery Mechanism for Forgotten Password
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because
- 8.8 High severity
Piwigo: Weak Password Recovery Mechanism for Forgotten Password
Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this
- 8.1 High severity
Brokerage Automation: Authentication Bypass by Assumed-Immutable Data
Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication
- 9.8 Critical severity
EIP Plus: Weak Password Recovery Mechanism for Forgotten Password
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
- 8.8 High severity
zitadel: URL Redirection to Untrusted Site
Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct t
- 7.0 High severity
Productivity Suite: Weak Password Recovery Mechanism for Forgotten Password
A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question.
- 8.1 High severity
NSX: Weak Password Recovery Mechanism for Forgotten Password
VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack
- 9.8 Critical severity
Security Gateway: Weak Password Recovery Mechanism for Forgotten Password
Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials.
- 9.8 Critical severity
Material Dashboard: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
- 8.9 High severity
Natours: Weak Password Recovery Mechanism for Forgotten Password
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c
- 8.8 High severity
kanboard: Weak Password Recovery Mechanism for Forgotten Password
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (defaul
- 9.8 Critical severity
Allegra: Weak Password Recovery Mechanism for Forgotten Password
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The spe
- 9.8 Critical severity
进取 750W: Unverified Password Change
A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 l
- 9.8 Critical severity
PSW Front-end Login & Registration: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a th
- 7.5 High severity
DI-7003GV2: Unverified Password Change
A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This affects the function sub_41F4F0 of the file /H5/webgl.asp?tggl_port=0&remote_management=0&http_passwd=game&exec_service=admin-restart. The manipulation
- 8.1 High severity
ContiNew Admin: Unverified Password Change
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack
- 9.8 Critical severity
Paid Videochat Turnkey Site: Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Password Recovery Exploitation.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.11.
- 8.8 High severity
BoomBox Theme Extensions: Weak Password Recovery Mechanism for Forgotten Password
The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0. This is due to the plugin not properly validating a user's identity prior to updating their password throu
- 8.3 High severity
CAP back office application: Weak Password Recovery Mechanism for Forgotten Password
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which coul