CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
431 vulnerabilities reference this CWE, most recent first.
GHSA-CQ63-2G3G-QJF5
Vulnerability from github – Published: 2025-02-28 09:30 – Updated: 2025-02-28 09:30The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
{
"affected": [],
"aliases": [
"CVE-2025-1570"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-28T09:15:12Z",
"severity": "HIGH"
},
"details": "The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.",
"id": "GHSA-cq63-2g3g-qjf5",
"modified": "2025-02-28T09:30:55Z",
"published": "2025-02-28T09:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1570"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3246340/directorist"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/853562ed-7f2e-453c-b3d0-67c90bd0231f?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CQ6M-74R4-X77G
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2024-02-28 21:03Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.cloudfoundry.identity:cloudfoundry-identity-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5172"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-28T21:03:01Z",
"nvd_published_at": "2017-10-24T17:29:00Z",
"severity": "CRITICAL"
},
"details": "Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.",
"id": "GHSA-cq6m-74r4-x77g",
"modified": "2024-02-28T21:03:01Z",
"published": "2022-05-13T01:07:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5172"
},
{
"type": "WEB",
"url": "https://github.com/cloudfoundry/uaa/commit/cd31cc397fe17389d95b83d6a9caa46eebc54faf"
},
{
"type": "PACKAGE",
"url": "https://github.com/cloudfoundry/uaa"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2015-5170-5173"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password"
}
GHSA-CQMJ-26M2-WVGH
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server
{
"affected": [],
"aliases": [
"CVE-2018-7811"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-30T19:29:00Z",
"severity": "CRITICAL"
},
"details": "An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server",
"id": "GHSA-cqmj-26m2-wvgh",
"modified": "2022-05-13T01:53:59Z",
"published": "2022-05-13T01:53:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7811"
},
{
"type": "WEB",
"url": "https://security.cse.iitk.ac.in/responsible-disclosure"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2018-38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CWXF-925X-2CCM
Vulnerability from github – Published: 2026-08-11 15:32 – Updated: 2026-08-11 15:32n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
{
"affected": [],
"aliases": [
"CVE-2026-72772"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T13:19:07Z",
"severity": "HIGH"
},
"details": "n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key\u0027s permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.",
"id": "GHSA-cwxf-925x-2ccm",
"modified": "2026-08-11T15:32:38Z",
"published": "2026-08-11T15:32:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72772"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-token-exchange"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CXH2-HXRP-WMGX
Vulnerability from github – Published: 2023-10-29 03:30 – Updated: 2023-10-29 03:30Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.
{
"affected": [],
"aliases": [
"CVE-2023-5840"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-29T01:15:41Z",
"severity": "MODERATE"
},
"details": "Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.",
"id": "GHSA-cxh2-hxrp-wmgx",
"modified": "2023-10-29T03:30:30Z",
"published": "2023-10-29T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5840"
},
{
"type": "WEB",
"url": "https://github.com/linkstackorg/linkstack/commit/fe7b99eae88f9e4c4cd4b00bab372cbf4b584b16"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/8042d8c3-650e-4c0d-9146-d9ccf6082b30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F3CP-F6PH-XXHJ
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.
{
"affected": [],
"aliases": [
"CVE-2021-39899"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-04T17:15:00Z",
"severity": "MODERATE"
},
"details": "In all versions of GitLab CE/EE, an attacker with physical access to a user\u2019s machine may brute force the user\u2019s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account and splitting the attack over several IP addresses and passing in the compromised session value from these various locations.",
"id": "GHSA-f3cp-f6ph-xxhj",
"modified": "2022-05-24T22:28:35Z",
"published": "2022-05-24T22:28:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39899"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39899.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/339154"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F3W6-R2G2-VX25
Vulnerability from github – Published: 2025-12-15 03:30 – Updated: 2025-12-15 03:30A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this vulnerability is an unknown functionality of the file /api/GylOperator/UpdatePasswordBatch. The manipulation leads to weak password recovery. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-14696"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-15T02:15:36Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this vulnerability is an unknown functionality of the file /api/GylOperator/UpdatePasswordBatch. The manipulation leads to weak password recovery. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-f3w6-r2g2-vx25",
"modified": "2025-12-15T03:30:18Z",
"published": "2025-12-15T03:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14696"
},
{
"type": "WEB",
"url": "https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1"
},
{
"type": "WEB",
"url": "https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1#issue-3688839620"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.336414"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.336414"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.705601"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F473-4GX3-59RW
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user.
{
"affected": [],
"aliases": [
"CVE-2020-26061"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-05T14:15:00Z",
"severity": "HIGH"
},
"details": "ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user.",
"id": "GHSA-f473-4gx3-59rw",
"modified": "2022-05-24T17:30:06Z",
"published": "2022-05-24T17:30:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26061"
},
{
"type": "WEB",
"url": "https://github.com/missing0x00/CVE-2020-26061"
},
{
"type": "WEB",
"url": "https://www.clickstudios.com.au/passwordstate-changelog.aspx"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FCC4-FHGG-298H
Vulnerability from github – Published: 2022-05-14 01:38 – Updated: 2022-05-14 01:38An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.
{
"affected": [],
"aliases": [
"CVE-2018-17298"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-21T07:29:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.",
"id": "GHSA-fcc4-fhgg-298h",
"modified": "2022-05-14T01:38:22Z",
"published": "2022-05-14T01:38:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17298"
},
{
"type": "WEB",
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=4050b0aafd18346d9a6a06967bfb1170824dab17"
},
{
"type": "WEB",
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=b87d3b807f39c00371ebaa50f938cb0110113538"
},
{
"type": "WEB",
"url": "https://tuleap.net/plugins/tracker/?aid=12219"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FCHW-39VQ-2WVV
Vulnerability from github – Published: 2022-05-17 01:57 – Updated: 2022-05-17 01:57An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
{
"affected": [],
"aliases": [
"CVE-2017-12850"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-14T20:29:00Z",
"severity": "HIGH"
},
"details": "An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.",
"id": "GHSA-fchw-39vq-2wvv",
"modified": "2022-05-17T01:57:51Z",
"published": "2022-05-17T01:57:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12850"
},
{
"type": "WEB",
"url": "https://github.com/kanboard/kanboard/commit/88dd6abbf3f519897f2f6280e95c9eec9123a4ae"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100352"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.