CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
431 vulnerabilities reference this CWE, most recent first.
GHSA-45FW-396C-R96X
Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2024-04-04 00:02An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter.
{
"affected": [],
"aliases": [
"CVE-2019-11393"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-22T11:29:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter.",
"id": "GHSA-45fw-396c-r96x",
"modified": "2024-04-04T00:02:40Z",
"published": "2022-05-24T16:44:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11393"
},
{
"type": "WEB",
"url": "https://mmonit.com/wiki/MMonit/Release3-7-3"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46404"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4856-QXX9-MGF3
Vulnerability from github – Published: 2026-07-01 00:34 – Updated: 2026-07-01 18:31An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to execute arbitrary code via the register function in inc/auth.php
{
"affected": [],
"aliases": [
"CVE-2026-37106"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T22:16:46Z",
"severity": "CRITICAL"
},
"details": "An issue in DokuWiki 2025-05-14b \"Librarian\" 56.2 allows a remote attacker to execute arbitrary code via the register function in inc/auth.php",
"id": "GHSA-4856-qxx9-mgf3",
"modified": "2026-07-01T18:31:26Z",
"published": "2026-07-01T00:34:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37106"
},
{
"type": "WEB",
"url": "https://github.com/dokuwiki/dokuwiki/issues/4682"
},
{
"type": "WEB",
"url": "https://gist.github.com/KyrieKlay/3260f4eeea025f2cd1daa7eb1360c5a1"
},
{
"type": "WEB",
"url": "https://github.com/dokuwiki/dokuwiki"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-497F-737R-X78P
Vulnerability from github – Published: 2025-01-08 09:30 – Updated: 2025-01-08 09:30The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
{
"affected": [],
"aliases": [
"CVE-2024-11350"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T09:15:06Z",
"severity": "CRITICAL"
},
"details": "The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
"id": "GHSA-497f-737r-x78p",
"modified": "2025-01-08T09:30:38Z",
"published": "2025-01-08T09:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11350"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/adforest-classified-wordpress-theme/19481695"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4GFX-85VX-RRGG
Vulnerability from github – Published: 2025-09-09 18:31 – Updated: 2026-04-01 18:36Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard. This issue affects Material Dashboard: from n/a through 1.4.6.
{
"affected": [],
"aliases": [
"CVE-2025-32486"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T17:15:43Z",
"severity": "CRITICAL"
},
"details": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard. This issue affects Material Dashboard: from n/a through 1.4.6.",
"id": "GHSA-4gfx-85vx-rrgg",
"modified": "2026-04-01T18:36:07Z",
"published": "2025-09-09T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32486"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/material-dashboard/vulnerability/wordpress-material-dashboard-1-4-6-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4GV3-MC9P-5WQC
Vulnerability from github – Published: 2026-08-18 18:32 – Updated: 2026-08-28 22:53A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.0.0"
},
{
"fixed": "26.4.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"fixed": "26.6.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.7.0"
},
{
"fixed": "26.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-18963"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T22:53:41Z",
"nvd_published_at": "2026-08-18T17:16:57Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
"id": "GHSA-4gv3-mc9p-5wqc",
"modified": "2026-08-28T22:53:41Z",
"published": "2026-08-18T18:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/51833"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/51844"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/dc2d4e524b4dae85aedc87ca28b9e4fa567d56c1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56520"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56523"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18963"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak: Unauthenticated account takeover via reset-credentials flow bypass"
}
GHSA-4HW9-GJ93-W3GR
Vulnerability from github – Published: 2022-12-21 18:30 – Updated: 2022-12-21 18:30Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).
{
"affected": [],
"aliases": [
"CVE-2022-47377"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T15:15:00Z",
"severity": "CRITICAL"
},
"details": "Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version \u003c1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version \u003e= 1.13.4 as soon as possible (available in SICK Support Portal).",
"id": "GHSA-4hw9-gj93-w3gr",
"modified": "2022-12-21T18:30:24Z",
"published": "2022-12-21T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47377"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4J4G-JHQH-8V4W
Vulnerability from github – Published: 2026-08-09 18:30 – Updated: 2026-08-09 18:30A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-19361"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-09T18:16:42Z",
"severity": "LOW"
},
"details": "A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.",
"id": "GHSA-4j4g-jhqh-8v4w",
"modified": "2026-08-09T18:30:26Z",
"published": "2026-08-09T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19361"
},
{
"type": "WEB",
"url": "https://github.com/macrozheng/mall/issues/979"
},
{
"type": "WEB",
"url": "https://github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication/issues/1"
},
{
"type": "WEB",
"url": "https://github.com/macrozheng/mall"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-19361"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/866081"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387215"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/387215/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4JJC-6XJ9-R5Q6
Vulnerability from github – Published: 2023-11-18 03:30 – Updated: 2023-11-18 03:30The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
{
"affected": [],
"aliases": [
"CVE-2023-4214"
],
"database_specific": {
"cwe_ids": [
"CWE-620",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-18T02:15:49Z",
"severity": "HIGH"
},
"details": "The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.",
"id": "GHSA-4jjc-6xj9-r5q6",
"modified": "2023-11-18T03:30:20Z",
"published": "2023-11-18T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4214"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_API_Limit.php?rev=2997182"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/apppresser/trunk/inc/AppPresser_WPAPI_Mods.php#L567"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2997160/apppresser"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c44c36a-c4c7-49c2-b750-1589e7840dde?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4RF6-VJG6-7466
Vulnerability from github – Published: 2024-12-06 18:30 – Updated: 2024-12-06 18:30Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.
{
"affected": [],
"aliases": [
"CVE-2024-47547"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T18:15:25Z",
"severity": "CRITICAL"
},
"details": "Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.",
"id": "GHSA-4rf6-vjg6-7466",
"modified": "2024-12-06T18:30:46Z",
"published": "2024-12-06T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47547"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4RJ6-94PR-R3H5
Vulnerability from github – Published: 2026-06-12 15:30 – Updated: 2026-06-12 15:30A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
{
"affected": [],
"aliases": [
"CVE-2026-12066"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T14:16:30Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.",
"id": "GHSA-4rj6-94pr-r3h5",
"modified": "2026-06-12T15:30:34Z",
"published": "2026-06-12T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12066"
},
{
"type": "WEB",
"url": "https://github.com/pbootcmspro/PbootCMS/issues/38"
},
{
"type": "WEB",
"url": "https://github.com/yunyan05/MYCVE/tree/main/PbootCMS/V3.2.12-Account-Takeover"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12066"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/828374"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370561"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370561/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.