CVE-2026-28213

9.8 criticalEPSS 0.5%

Critical (9.8) in evershop evershop. EPSS 0.5% chance of exploitation in the next 30 days.

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWEs: CWE-640, CWE-200
Published: 2026-02-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

evershop:evershop

References

https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1
https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw

Check your stack JSON