CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
415 vulnerabilities reference this CWE, most recent first.
GHSA-4RJ6-94PR-R3H5
Vulnerability from github – Published: 2026-06-12 15:30 – Updated: 2026-06-12 15:30A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
{
"affected": [],
"aliases": [
"CVE-2026-12066"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-12T14:16:30Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.",
"id": "GHSA-4rj6-94pr-r3h5",
"modified": "2026-06-12T15:30:34Z",
"published": "2026-06-12T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12066"
},
{
"type": "WEB",
"url": "https://github.com/pbootcmspro/PbootCMS/issues/38"
},
{
"type": "WEB",
"url": "https://github.com/yunyan05/MYCVE/tree/main/PbootCMS/V3.2.12-Account-Takeover"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-12066"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/828374"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370561"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/370561/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4XW8-RVQF-QCHF
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.
{
"affected": [],
"aliases": [
"CVE-2018-8916"
],
"database_specific": {
"cwe_ids": [
"CWE-620",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-08T13:29:00Z",
"severity": "HIGH"
},
"details": "Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.",
"id": "GHSA-4xw8-rvqf-qchf",
"modified": "2022-05-13T01:31:42Z",
"published": "2022-05-13T01:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8916"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/support/security/Synology_SA_18_24"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-52CR-X5C3-F4QR
Vulnerability from github – Published: 2022-05-14 01:21 – Updated: 2022-05-14 01:21Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."
{
"affected": [],
"aliases": [
"CVE-2015-4689"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-11T20:29:00Z",
"severity": "CRITICAL"
},
"details": "Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka \"Weak Password Reset.\"",
"id": "GHSA-52cr-x5c3-f4qr",
"modified": "2022-05-14T01:21:26Z",
"published": "2022-05-14T01:21:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4689"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134622/Banner-Student-XSS-Information-Disclosure-Open-Redirect.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/537029/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-52JR-7FQR-H29H
Vulnerability from github – Published: 2024-09-25 03:30 – Updated: 2025-11-04 18:31The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.
{
"affected": [],
"aliases": [
"CVE-2024-8878"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-25T01:15:47Z",
"severity": "CRITICAL"
},
"details": "The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.",
"id": "GHSA-52jr-7fqr-h29h",
"modified": "2025-11-04T18:31:25Z",
"published": "2024-09-25T03:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8878"
},
{
"type": "WEB",
"url": "https://cyberdanube.com/en/en-multiple-vulnerabilities-in-riello-netman-204/index.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/50"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5444-VC88-HFJH
Vulnerability from github – Published: 2024-03-21 15:31 – Updated: 2024-08-02 00:31Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1.
{
"affected": [],
"aliases": [
"CVE-2024-2463"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T15:16:54Z",
"severity": "HIGH"
},
"details": "Weak password recovery mechanism in CDeX application allows to retrieve\u00a0password\u00a0reset token.This issue affects CDeX application versions through 5.7.1.\n\n",
"id": "GHSA-5444-vc88-hfjh",
"modified": "2024-08-02T00:31:25Z",
"published": "2024-03-21T15:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2463"
},
{
"type": "WEB",
"url": "https://cdex.cloud"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2024/03/CVE-2024-2463"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2024/03/CVE-2024-2463"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-556C-JFJ4-29VC
Vulnerability from github – Published: 2024-04-09 03:30 – Updated: 2024-04-09 03:30Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.
{
"affected": [],
"aliases": [
"CVE-2024-27899"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T01:15:48Z",
"severity": "HIGH"
},
"details": "Self-Registration\u00a0and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.\n\n",
"id": "GHSA-556c-jfj4-29vc",
"modified": "2024-04-09T03:30:52Z",
"published": "2024-04-09T03:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27899"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3434839"
},
{
"type": "WEB",
"url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-5656-6HGP-4V5V
Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-06-24 09:30The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the pravel_invoice_change_password() function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied reset_activation_code POST parameter and the target user's stored forgot_email user meta — a check that trivially evaluates to true ('' == '') for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the reset_user_id POST parameter, bypass the activation code check entirely by omitting reset_activation_code, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.
{
"affected": [],
"aliases": [
"CVE-2026-12416"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T07:16:26Z",
"severity": "CRITICAL"
},
"details": "The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user\u0027s stored `forgot_email` user meta \u2014 a check that trivially evaluates to true (`\u0027\u0027 == \u0027\u0027`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account\u0027s password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.",
"id": "GHSA-5656-6hgp-4v5v",
"modified": "2026-06-24T09:30:45Z",
"published": "2026-06-24T09:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12416"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php#L296"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php#L303"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php#L52"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0fbe84-e455-4e62-9c48-49340d08f81d?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-56V2-RM7H-G26F
Vulnerability from github – Published: 2026-08-13 15:34 – Updated: 2026-08-13 15:34Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
{
"affected": [],
"aliases": [
"CVE-2026-61967"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T14:17:02Z",
"severity": "CRITICAL"
},
"details": "Unauthenticated Privilege Escalation in miniorange otp verification \u003c= 5.5.1 versions.",
"id": "GHSA-56v2-rm7h-g26f",
"modified": "2026-08-13T15:34:39Z",
"published": "2026-08-13T15:34:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61967"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-57VM-X738-VVVH
Vulnerability from github – Published: 2022-11-17 03:30 – Updated: 2022-11-20 15:30An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.
{
"affected": [],
"aliases": [
"CVE-2022-44004"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-16T23:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.",
"id": "GHSA-57vm-x738-vvvh",
"modified": "2022-11-20T15:30:17Z",
"published": "2022-11-17T03:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44004"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-030.txt"
},
{
"type": "WEB",
"url": "https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-58JG-CXMW-686H
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-16 00:01An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.
{
"affected": [],
"aliases": [
"CVE-2021-43498"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-08T19:15:00Z",
"severity": "HIGH"
},
"details": "An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.",
"id": "GHSA-58jg-cxmw-686h",
"modified": "2022-04-16T00:01:25Z",
"published": "2022-04-09T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43498"
},
{
"type": "WEB",
"url": "https://github.com/atutor/ATutor/blob/master/password_reminder.php"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/157563/ATutor-LMS-2.2.4-Weak-Password-Reset-Hash.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.