Skip to content
OpenAdvisories

Weakness (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Base Incomplete

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

How to prevent it (6 mitigations)

  1. Architecture and Design

    Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.

  2. Architecture and Design

    Do not use standard weak security questions and use several security questions.

  3. Architecture and Design

    Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.

  4. Architecture and Design

    Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.

  5. Architecture and Design

    Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.

  6. Architecture and Design

    Assign a new temporary password rather than revealing the original password.

Source: MITRE CWE-640

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.3
    CVE-2026-93453 Public exploit

    SOGo before 5.12.11 Password Reset Token Interception via Origin Header

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.5
    CVE-2026-7459 Public exploit

    Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

    The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unreact_to_event(…

    eskapism Simple History – Track, Log, and Audit WordPress Changes Web / CMS
  • High 8.8
    CVE-2017-7615 Public exploit EPSS 91%

    MantisBT allows arbitrary password reset

    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

    mantisbt/mantisbt Packagist
  • High 7.5
    CVE-2017-5594 Public exploit

    Pagekit Weak Password Recovery Mechanism for Forgotten Password

    An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID …

    pagekit/pagekit Packagist