CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
431 vulnerabilities reference this CWE, most recent first.
GHSA-748X-222R-QC52
Vulnerability from github – Published: 2022-05-17 01:22 – Updated: 2025-04-20 03:43ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".
{
"affected": [],
"aliases": [
"CVE-2015-7257"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-24T20:29:00Z",
"severity": "HIGH"
},
"details": "ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from \"support\" to \"admin\".",
"id": "GHSA-748x-222r-qc52",
"modified": "2025-04-20T03:43:49Z",
"published": "2022-05-17T01:22:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7257"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/38772"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Nov/48"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-75R8-6X58-82P6
Vulnerability from github – Published: 2024-11-14 12:31 – Updated: 2024-11-14 12:31IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.
{
"affected": [],
"aliases": [
"CVE-2024-45670"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-14T12:15:18Z",
"severity": "MODERATE"
},
"details": "IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.",
"id": "GHSA-75r8-6x58-82p6",
"modified": "2024-11-14T12:31:03Z",
"published": "2024-11-14T12:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45670"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7172206"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-78WQ-6GCV-W28R
Vulnerability from github – Published: 2026-02-13 22:49 – Updated: 2026-02-13 22:49Summary
A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox.
Details
The vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code.
Specifically, the sensitive token is embedded in:
Because this page is accessible via a GET request using the victim's email as a parameter, an attacker can programmatically extract the token.
PoC
- The attacker asks for a password reset for the victim
-
The attacker makes the following curl command on the terminal using the victim's email, and is able to get the code that was sent as an hidden field in the HTML.
-
With this code, the attacker is able to use it in order to reset the victim password.
- The attacker is able to login with the new password.
Impact
- An attacker can compromise any account on the platform, including administrative accounts, resulting in total loss of Confidentiality, Integrity, and Availability.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.6.2"
},
"package": {
"ecosystem": "Packagist",
"name": "idno/known"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-26273"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-13T22:49:27Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nA Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user\u0027s email, leading to full Account Takeover (ATO) without requiring access to the victim\u0027s email inbox.\n\n### Details\nThe vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code.\n\nSpecifically, the sensitive token is embedded in:\n\u003cinput type=\"hidden\" name=\"code\" value=\"[SECRET_TOKEN]\"\u003e\n\nBecause this page is accessible via a GET request using the victim\u0027s email as a parameter, an attacker can programmatically extract the token.\n\n### PoC\n1. The attacker asks for a password reset for the victim\n\n\u003cimg width=\"1328\" height=\"580\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0197907e-f10b-4e6d-989e-f25c408862cd\" /\u003e\n\n\u003cimg width=\"1139\" height=\"452\" alt=\"image(1)\" src=\"https://github.com/user-attachments/assets/9a317b27-b56a-4663-9965-d3e660713f4e\" /\u003e\n\n\n2. The attacker makes the following curl command on the terminal using the victim\u0027s email, and is able to get the code that was sent as an hidden field in the HTML.\n\u003cimg width=\"917\" height=\"220\" alt=\"image(2)\" src=\"https://github.com/user-attachments/assets/af89ba3b-de56-4437-84b3-c1feb56d2348\" /\u003e\n\n3. With this code, the attacker is able to use it in order to reset the victim password.\n\u003cimg width=\"1335\" height=\"711\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/498b8a2e-9eb2-4b50-bc35-26b0f2764c8d\" /\u003e\n\n\u003cimg width=\"1258\" height=\"524\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/d1304dc3-bf56-4ec7-920c-ecce502db6b0\" /\u003e\n\n4. The attacker is able to login with the new password.\n\n\u003cimg width=\"1514\" height=\"631\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/2533032e-6f0d-45c8-9fe1-881bfedebcc4\" /\u003e\n\n\u003cimg width=\"1528\" height=\"647\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/a6e9144c-cc96-493d-8780-9156c299a192\" /\u003e\n\n\n\n### Impact\n- An attacker can compromise any account on the platform, including administrative accounts, resulting in total loss of Confidentiality, Integrity, and Availability.",
"id": "GHSA-78wq-6gcv-w28r",
"modified": "2026-02-13T22:49:27Z",
"published": "2026-02-13T22:49:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r"
},
{
"type": "WEB",
"url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a"
},
{
"type": "PACKAGE",
"url": "https://github.com/idno/known"
},
{
"type": "WEB",
"url": "https://github.com/idno/known/releases/tag/1.6.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Known affected by Account Takeover via Password Reset Token Leakage"
}
GHSA-796C-884R-78PP
Vulnerability from github – Published: 2026-08-14 00:32 – Updated: 2026-08-14 00:32Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.
{
"affected": [],
"aliases": [
"CVE-2026-72856"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T22:17:24Z",
"severity": "HIGH"
},
"details": "Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user \u2014 including a lowest-privilege BASIC app user \u2014 can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access.",
"id": "GHSA-796c-884r-78pp",
"modified": "2026-08-14T00:32:02Z",
"published": "2026-08-14T00:32:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-j82g-67x3-xcwh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72856"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/budibase-before-authentication-bypass-via-tenant-owner-email"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7C6J-GM9G-QHCJ
Vulnerability from github – Published: 2022-05-14 03:18 – Updated: 2022-05-14 03:18An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
{
"affected": [],
"aliases": [
"CVE-2017-1000141"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-30T19:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user\u0027s ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.",
"id": "GHSA-7c6j-gm9g-qhcj",
"modified": "2022-05-14T03:18:33Z",
"published": "2022-05-14T03:18:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000141"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/mahara/+bug/1422492"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7FG8-FWGF-G9X2
Vulnerability from github – Published: 2024-10-25 15:31 – Updated: 2024-11-15 00:31An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.
{
"affected": [],
"aliases": [
"CVE-2024-48428"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T15:15:18Z",
"severity": "CRITICAL"
},
"details": "An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.",
"id": "GHSA-7fg8-fwgf-g9x2",
"modified": "2024-11-15T00:31:50Z",
"published": "2024-10-25T15:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48428"
},
{
"type": "WEB",
"url": "https://medium.com/%40powerful-/account-takeover-ato-via-the-reset-password-cve-2024-48428-84892d6211d6"
},
{
"type": "WEB",
"url": "https://medium.com/h7w/full-account-takeover-via-password-reset-link-manipulation-840fb9402967"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/posts/said-al-ghammari-301972285_0day-bugbountytips-bugbountytip-activity-7227418100034412544-2ocu"
},
{
"type": "WEB",
"url": "https://www.olivevle.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7FRC-FVV8-6VW2
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-9466"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-25T16:16:20Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateUserPassword of the component API Endpoint. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-7frc-fvv8-6vw2",
"modified": "2026-05-26T13:30:47Z",
"published": "2026-05-26T13:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9466"
},
{
"type": "WEB",
"url": "https://ucn9h68n9289.feishu.cn/wiki/DRghw6X8piOtClkjBkHcfgvtnPx?from=from_copylink"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/813990"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365447"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/365447/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GM6-W7MX-58CR
Vulnerability from github – Published: 2026-05-04 09:31 – Updated: 2026-06-18 20:07phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpbb/phpbb"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.3.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpbb/phpbb"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-a1"
},
{
"fixed": "4.0.0-a2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.0-a1"
]
}
],
"aliases": [
"CVE-2026-29199"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T20:07:10Z",
"nvd_published_at": "2026-05-04T07:15:59Z",
"severity": "HIGH"
},
"details": "phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.",
"id": "GHSA-7gm6-w7mx-58cr",
"modified": "2026-06-18T20:07:10Z",
"published": "2026-05-04T09:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29199"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3543246"
},
{
"type": "WEB",
"url": "https://blog.phpbb.com/2026/04/27/phpbb-4-0-0-a2-release"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpbb/phpbb-app"
},
{
"type": "WEB",
"url": "https://www.phpbb.com/community/viewtopic.php?t=2671024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "phpBB has Password Reset Link Poisoning via Host Header injection"
}
GHSA-7GXX-VCPP-M3J9
Vulnerability from github – Published: 2024-01-02 03:30 – Updated: 2024-01-02 03:30A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444.
{
"affected": [],
"aliases": [
"CVE-2024-0186"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-02T01:15:08Z",
"severity": "LOW"
},
"details": "A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recovery. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249444.",
"id": "GHSA-7gxx-vcpp-m3j9",
"modified": "2024-01-02T03:30:30Z",
"published": "2024-01-02T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0186"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/WwPWWizD2Spk"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.249444"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.249444"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7JMP-283P-H6XJ
Vulnerability from github – Published: 2025-06-23 21:31 – Updated: 2025-06-23 21:31Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.
{
"affected": [],
"aliases": [
"CVE-2025-6216"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-21T01:15:28Z",
"severity": "CRITICAL"
},
"details": "Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.",
"id": "GHSA-7jmp-283p-h6xj",
"modified": "2025-06-23T21:31:49Z",
"published": "2025-06-23T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6216"
},
{
"type": "WEB",
"url": "https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-410"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.