CVE-2026-108337
Description
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Is your site exposed to CVE-2026-108337?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-108337? +
How do I check if I'm vulnerable to CVE-2026-108337? +
Related Vulnerabilities
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server …
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. …
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An …
Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a …
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a …
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker …