Weakness (CWE)
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How to prevent it (6 mitigations)
-
Architecture and Design
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
-
Architecture and Design
Do not use standard weak security questions and use several security questions.
-
Architecture and Design
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
-
Architecture and Design
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
-
Architecture and Design
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
-
Architecture and Design
Assign a new temporary password rather than revealing the original password.
Source: MITRE CWE-640
12 results · Clear filters · Feed
-
Critical 9.1CVE-2026-116214 Public exploit
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via use…
-
Critical 9.8CVE-2026-19632 Public exploit
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible f…
-
Critical 9.1CVE-2026-18963 Public exploit
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for a…
-
Critical 9.4CVE-2026-53595 Public exploit
FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash`…
-
Critical 9.8CVE-2026-12416 Public exploit
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce…
-
Critical 9.8CVE-2026-11551 Public exploit
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…
-
Critical 10.0CVE-2025-63314 Public exploit
A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to …
-
Critical 9.8CVE-2025-50433 Public exploit
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted …
-
Critical 9.8
WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a t…
-
Critical 10.0
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account passwor…
KEV May 1, 2024 -
Critical 9.8
Django Potential account hijack via password reset form
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.