cve.bz

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Filter

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

What the weakness is: CWE-640 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-640, as MITRE names them. Credits.

Ask an AI about CWE-640

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-640: Weak Password Recovery Mechanism for Forgotten Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/640.html and https://cve.bz/cve/cwe/640?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.3CVE-2026-114421

    SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such…

  2. 8.6CVE-2026-119127EPSS 0.3%

    ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host…

  3. 9.3CVE-2026-116214EPSS 0.5%

    MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their…

  4. 8.1CVE-2026-94380EPSS 0.3%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

  5. 6.9CVE-2026-115973EPSS 0.3%

    A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController…

  6. 8.3CVE-2026-58202EPSS 0.2%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unaut…

  7. 6.8CVE-2026-46347EPSS 0.3%

    The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and…

  8. 6.5CVE-2026-46346EPSS 0.3%

    The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target…

  9. 8.7CVE-2026-86055EPSS 0.6%

    Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no tru…

  10. 9.2CVE-2026-43845EPSS 0.5%

    A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

  11. 2.1CVE-2026-112035EPSS 0.3%

    A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. …

  12. 7.1CVE-2026-16437EPSS 0.09%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3…

  13. 9.2CVE-2026-16436EPSS 0.3%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3…

  14. 7.4CVE-2026-108337EPSS 0.3%

    An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to…

  15. 9.1CVE-2026-108335EPSS 0.2%

    When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility…

  16. 9.1CVE-2026-63159EPSS 0.3%

    Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reu…

  17. 8.1CVE-2026-70175EPSS 0.7%

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

  18. 9.1CVE-2026-53997EPSS 0.4%

    Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthentica…

  19. 5.3CVE-2026-109204EPSS 0.2%

    LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account a…

  20. 7.6CVE-2026-108737EPSS 0.3%

    Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset lin…

  21. 9.3CVE-2026-107640EPSS 0.4%

    Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target …

  22. 9.1CVE-2026-19218EPSS 0.2%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.0…

  23. 4.8CVE-2026-105785EPSS 0.2%

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-…

  24. 9.1CVE-2026-53953EPSS 0.4%

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an …

  25. 9.8CVE-2026-102115EPSS 1.0%

    Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password…

  26. 5.5CVE-2026-101188EPSS 0.4%

    A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remo…

  27. 8.7CVE-2026-100870EPSS 0.3%

    Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controll…

  28. 7.4CVE-2026-93340EPSS 0.5%

    Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in t…

  29. 8.7CVE-2026-93453EPSS 0.5%

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password reco…

  30. 8.8CVE-2026-14850EPSS 0.4%

    The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users w…

  31. 5.5CVE-2026-90522EPSS 0.5%

    A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipul…

  32. 6.3CVE-2026-81905EPSS 0.4%

    Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone…

  33. 7.5CVE-2026-6285EPSS 0.4%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.

  34. 5.5CVE-2026-86260EPSS 0.6%

    A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of t…

  35. 9.8CVE-2026-71625EPSS 0.7%

    An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

  36. 9.3CVE-2026-84699EPSS 0.6%

    Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized…

  37. 2.1CVE-2026-82487EPSS 0.3%

    A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be…

  38. 8.7CVE-2026-80196EPSS 0.5%

    Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or c…

  39. 9.8CVE-2026-19632ExploitEPSS 4.5%

    The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This…

  40. 9.8CVE-2026-77264EPSS 0.7%

    The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handle_email_otp_return() fu…

  41. 9.1CVE-2026-18963ExploitEPSS 4.7%

    A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password…

  42. 9.8CVE-2026-15689EPSS 0.6%

    Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Both default emails emit a link of the form `$ba…

  43. 9.8CVE-2026-12949EPSS 0.5%

    The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration co…

  44. 8.6CVE-2026-72856EPSS 0.5%

    Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRest…

  45. 9.8CVE-2026-66691EPSS 0.5%

    Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

  46. 9.8CVE-2026-61967EPSS 0.5%

    Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

  47. 9.8CVE-2026-12571EPSS 3.3%

    An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

  48. 8.9CVE-2026-72772EPSS 0.4%

    n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the…

  49. 2.9CVE-2026-19361EPSS 0.4%

    A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be laun…

  50. 9.8CVE-2026-14364EPSS 0.5%

    The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly val…