CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
431 vulnerabilities reference this CWE, most recent first.
GHSA-RG9F-H2V7-XH94
Vulnerability from github – Published: 2026-07-12 06:31 – Updated: 2026-07-12 06:31A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-15479"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-12T06:16:41Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.",
"id": "GHSA-rg9f-h2v7-xh94",
"modified": "2026-07-12T06:31:11Z",
"published": "2026-07-12T06:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15479"
},
{
"type": "WEB",
"url": "https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/pre_auth_pwd_change"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-15479"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/837069"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377785"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/377785/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RG9R-F32F-755R
Vulnerability from github – Published: 2023-02-02 00:30 – Updated: 2023-02-08 21:30An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.
{
"affected": [],
"aliases": [
"CVE-2022-45782"
],
"database_specific": {
"cwe_ids": [
"CWE-338",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-01T22:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.",
"id": "GHSA-rg9r-f32f-755r",
"modified": "2023-02-08T21:30:19Z",
"published": "2023-02-02T00:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45782"
},
{
"type": "WEB",
"url": "https://www.dotcms.com/security/SI-66"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RH6H-F4GJ-HPGV
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
{
"affected": [],
"aliases": [
"CVE-2021-36209"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T14:15:00Z",
"severity": "CRITICAL"
},
"details": "In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.",
"id": "GHSA-rh6h-f4gj-hpgv",
"modified": "2022-05-24T19:10:19Z",
"published": "2022-05-24T19:10:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36209"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RH7C-27W5-QH7X
Vulnerability from github – Published: 2025-03-08 00:31 – Updated: 2025-03-08 00:31A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argument email/phone number leads to weak password recovery. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-2093"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z",
"severity": "LOW"
},
"details": "A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argument email/phone number leads to weak password recovery. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-rh7c-27w5-qh7x",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2093"
},
{
"type": "WEB",
"url": "https://github.com/SECWG/cve/issues/4"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RP89-32RP-QPQ2
Vulnerability from github – Published: 2022-05-13 01:12 – Updated: 2024-04-24 20:18An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5594"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:18:58Z",
"nvd_published_at": "2017-01-25T18:59:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user\u0027s password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.",
"id": "GHSA-rp89-32rp-qpq2",
"modified": "2024-04-24T20:18:58Z",
"published": "2022-05-13T01:12:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5594"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
},
{
"type": "WEB",
"url": "https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf"
},
{
"type": "WEB",
"url": "https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41143"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95806"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pagekit Weak Password Recovery Mechanism for Forgotten Password"
}
GHSA-RQ4Q-7XVX-8F5W
Vulnerability from github – Published: 2024-10-16 03:31 – Updated: 2025-05-17 03:30The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
{
"affected": [],
"aliases": [
"CVE-2024-9305"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-16T02:15:07Z",
"severity": "HIGH"
},
"details": "The AppPresser \u2013 Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.",
"id": "GHSA-rq4q-7xvx-8f5w",
"modified": "2025-05-17T03:30:30Z",
"published": "2024-10-16T03:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9305"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3168744%40apppresser\u0026new=3168744%40apppresser\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RR4Q-QMWM-H86V
Vulnerability from github – Published: 2022-05-14 03:53 – Updated: 2022-05-14 03:53389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.
{
"affected": [],
"aliases": [
"CVE-2017-7551"
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-16T18:29:00Z",
"severity": "CRITICAL"
},
"details": "389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.",
"id": "GHSA-rr4q-qmwm-h86v",
"modified": "2022-05-14T03:53:46Z",
"published": "2022-05-14T03:53:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2569"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-7551"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1477669"
},
{
"type": "WEB",
"url": "https://pagure.io/389-ds-base/issue/49336"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V3J7-7H3R-662C
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.
{
"affected": [],
"aliases": [
"CVE-2021-31912"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-11T13:15:00Z",
"severity": "HIGH"
},
"details": "In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.",
"id": "GHSA-v3j7-7h3r-662c",
"modified": "2022-05-24T19:02:07Z",
"published": "2022-05-24T19:02:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31912"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-V5MF-VJW2-X655
Vulnerability from github – Published: 2023-06-29 18:30 – Updated: 2024-04-04 05:18The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.
{
"affected": [],
"aliases": [
"CVE-2023-36487"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-29T17:15:09Z",
"severity": "CRITICAL"
},
"details": "The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.",
"id": "GHSA-v5mf-vjw2-x655",
"modified": "2024-04-04T05:18:06Z",
"published": "2023-06-29T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36487"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?ref_id=1719\u0026obj_id=141694\u0026obj_type=PageObject\u0026cmd=layout\u0026cmdClass=illmpresentationgui\u0026cmdNode=13g\u0026baseClass=ilLMPresentationGUI"
},
{
"type": "WEB",
"url": "https://docu.ilias.de/ilias.php?ref_id=1719\u0026obj_id=141703\u0026obj_type=PageObject\u0026cmd=layout\u0026cmdClass=illmpresentationgui\u0026cmdNode=13g\u0026baseClass=ilLMPresentationGUI"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V683-RCXX-VPFF
Vulnerability from github – Published: 2023-10-10 21:30 – Updated: 2023-10-10 21:30Impact
ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL.
Patches
This bug has been patched in versions >2.27.2 beginning with 2.37.3 and 2.38.0
Workarounds
None available we advise to updated if this is needed.
References
None
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.37.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-44399"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-10T21:30:15Z",
"nvd_published_at": "2023-10-10T17:15:13Z",
"severity": "MODERATE"
},
"details": "### Impact\nZITADEL administrators can enable a setting called \"Ignoring unknown usernames\" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it did not work correctly on the password reset flow. This meant that even if this feature was active that an attacker could use the password reset function to verify if an account exist within ZITADEL.\n\n### Patches\nThis bug has been patched in versions \u003e2.27.2 beginning with [2.37.3](https://github.com/zitadel/zitadel/releases/tag/v2.37.3) and [2.38.0](https://github.com/zitadel/zitadel/releases/tag/v2.38.0)\n\n### Workarounds\nNone available we advise to updated if this is needed.\n\n### References\nNone\n",
"id": "GHSA-v683-rcxx-vpff",
"modified": "2023-10-10T21:30:15Z",
"published": "2023-10-10T21:30:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v683-rcxx-vpff"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44399"
},
{
"type": "PACKAGE",
"url": "https://github.com/zitadel/zitadel"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.37.3"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.38.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "ZITADEL\u0027s password reset does not respect the \"Ignoring unknown usernames\" setting"
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.