CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
431 vulnerabilities reference this CWE, most recent first.
GHSA-5976-FHM4-832H
Vulnerability from github – Published: 2026-03-10 18:31 – Updated: 2026-03-10 21:32Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.
{
"affected": [],
"aliases": [
"CVE-2025-69614"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-10T18:18:01Z",
"severity": "CRITICAL"
},
"details": "Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.",
"id": "GHSA-5976-fhm4-832h",
"modified": "2026-03-10T21:32:14Z",
"published": "2026-03-10T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69614"
},
{
"type": "WEB",
"url": "https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832"
},
{
"type": "WEB",
"url": "https://www.telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-59GG-H898-V8M7
Vulnerability from github – Published: 2024-03-25 09:32 – Updated: 2025-04-01 18:30This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.
{
"affected": [],
"aliases": [
"CVE-2024-2862"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-25T07:15:50Z",
"severity": "CRITICAL"
},
"details": "This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.",
"id": "GHSA-59gg-h898-v8m7",
"modified": "2025-04-01T18:30:38Z",
"published": "2024-03-25T09:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2862"
},
{
"type": "WEB",
"url": "https://lgsecurity.lge.com/bulletins/idproducts#updateDetails"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-59HH-4792-XV6G
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2024-04-04 01:14An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
{
"affected": [],
"aliases": [
"CVE-2019-13240"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-10T14:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user\u0027s password again during the next 24 hours without any information except the associated email address.",
"id": "GHSA-59hh-4792-xv6g",
"modified": "2024-04-04T01:14:07Z",
"published": "2022-05-24T16:49:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13240"
},
{
"type": "WEB",
"url": "https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7"
},
{
"type": "WEB",
"url": "https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6"
},
{
"type": "WEB",
"url": "https://github.com/glpi-project/glpi/compare/1783b78...8e621f6"
},
{
"type": "WEB",
"url": "https://github.com/glpi-project/glpi/releases/tag/9.4.1"
},
{
"type": "WEB",
"url": "https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5C37-5J7W-8MH8
Vulnerability from github – Published: 2026-06-09 18:31 – Updated: 2026-07-31 19:22LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "limesurvey/limesurvey"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.0-beta1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50635"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T19:22:30Z",
"nvd_published_at": "2026-06-09T18:17:10Z",
"severity": "HIGH"
},
"details": "LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target\u0027s username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host\u0027s newPassword endpoint to set a new password and take over the account.",
"id": "GHSA-5c37-5j7w-8mh8",
"modified": "2026-07-31T19:22:30Z",
"published": "2026-06-09T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50635"
},
{
"type": "WEB",
"url": "https://github.com/LimeSurvey/LimeSurvey/pull/5032"
},
{
"type": "WEB",
"url": "https://github.com/LimeSurvey/LimeSurvey/commit/ac2a4f1673de7b56e7a342c338f36e8bb077d4b3"
},
{
"type": "WEB",
"url": "https://github.com/LimeSurvey/LimeSurvey/commit/b394cb64328aa6db95e3304f82c8c9e603e9ceb0"
},
{
"type": "PACKAGE",
"url": "https://github.com/LimeSurvey/LimeSurvey"
},
{
"type": "WEB",
"url": "https://www.limesurvey.org"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/limesurvey-password-reset-host-header-injection-discloses-reset-token"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it."
}
GHSA-5CJR-78CQ-3WRG
Vulnerability from github – Published: 2022-05-10 00:00 – Updated: 2022-05-25 20:05Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.36"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29933"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-25T20:05:42Z",
"nvd_published_at": "2022-05-09T18:15:00Z",
"severity": "HIGH"
},
"details": "Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account\u0027s password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor\u0027s position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).",
"id": "GHSA-5cjr-78cq-3wrg",
"modified": "2022-05-25T20:05:42Z",
"published": "2022-05-10T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29933"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
},
{
"type": "WEB",
"url": "https://sec-consult.com/vulnerability-lab"
},
{
"type": "WEB",
"url": "https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper account password reset in Craft CMS"
}
GHSA-5QQ2-QMP3-F37Q
Vulnerability from github – Published: 2025-10-15 15:30 – Updated: 2025-10-15 18:31Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.
{
"affected": [],
"aliases": [
"CVE-2025-56748"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-15T15:16:04Z",
"severity": "MODERATE"
},
"details": "Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts.",
"id": "GHSA-5qq2-qmp3-f37q",
"modified": "2025-10-15T18:31:50Z",
"published": "2025-10-15T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56748"
},
{
"type": "WEB",
"url": "https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5VPJ-22HP-CHFG
Vulnerability from github – Published: 2025-09-29 21:30 – Updated: 2025-09-29 21:30VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.
Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 8.1 (High).
Acknowledgments: Reported by the National Security Agency.
Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x
NSX-T 3.x VMware Cloud Foundation (with NSX) 5.x, 4.5.x
Fixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None.
{
"affected": [],
"aliases": [
"CVE-2025-41251"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-29T19:15:35Z",
"severity": "HIGH"
},
"details": "VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks.\n\nImpact:\u00a0Username enumeration \u2192 credential brute force risk.\nAttack Vector:\u00a0Remote, unauthenticated.\nSeverity:\u00a0Important.\nCVSSv3:\u00a08.1 (High).\n\nAcknowledgments:\u00a0Reported by the National Security Agency.\n\nAffected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x\n\nNSX-T 3.x\nVMware Cloud Foundation (with NSX) 5.x, 4.5.x\n\nFixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287).\nWorkarounds: None.",
"id": "GHSA-5vpj-22hp-chfg",
"modified": "2025-09-29T21:30:26Z",
"published": "2025-09-29T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41251"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W3X-GFW2-FM64
Vulnerability from github – Published: 2022-05-14 03:15 – Updated: 2022-05-14 03:15In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user's password (including root). A low-privilege user could abuse this feature by changing the password of the 'kace_support' account, which comes disabled by default but has full sudo privileges.
{
"affected": [],
"aliases": [
"CVE-2018-11134"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-31T18:29:00Z",
"severity": "HIGH"
},
"details": "In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available commands allows changing any user\u0027s password (including root). A low-privilege user could abuse this feature by changing the password of the \u0027kace_support\u0027 account, which comes disabled by default but has full sudo privileges.",
"id": "GHSA-5w3x-gfw2-fm64",
"modified": "2022-05-14T03:15:28Z",
"published": "2022-05-14T03:15:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11134"
},
{
"type": "WEB",
"url": "https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64VH-QW36-84GX
Vulnerability from github – Published: 2022-05-14 03:42 – Updated: 2022-05-14 03:42In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.
{
"affected": [],
"aliases": [
"CVE-2017-8916"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-31T16:29:00Z",
"severity": "HIGH"
},
"details": "In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user\u0027s e-mail address and send a forgot password email to themselves, thereby gaining administrative access.",
"id": "GHSA-64vh-qw36-84gx",
"modified": "2022-05-14T03:42:42Z",
"published": "2022-05-14T03:42:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8916"
},
{
"type": "WEB",
"url": "https://www.cisecurity.org/cis-security-updates/incorrect-access-control-cve-2017-8916"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68F5-49RW-QGQ9
Vulnerability from github – Published: 2022-01-19 00:00 – Updated: 2022-01-26 00:03An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/adm_utilisateur/send-mail.json endpoint, a user can send a JSON array with user IDs that will have their passwords reset (and new ones sent to their respective e-mail addresses).
{
"affected": [],
"aliases": [
"CVE-2021-44839"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-18T20:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/adm_utilisateur/send-mail.json endpoint, a user can send a JSON array with user IDs that will have their passwords reset (and new ones sent to their respective e-mail addresses).",
"id": "GHSA-68f5-49rw-qgq9",
"modified": "2022-01-26T00:03:00Z",
"published": "2022-01-19T00:00:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44839"
},
{
"type": "WEB",
"url": "https://gist.github.com/rntcruz23/16ac2d9dfc7e32b0f57dc7b20f17cd29"
},
{
"type": "WEB",
"url": "https://www.deltarm.com"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.