CVE-2026-108337
Password Reset Code Accessible in User Listing API
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Password Reset Code Accessible in User Listing API
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- Record
CVE-2026-108337- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-640
- Updated
- 2026-11-02
EUVDEUVD-2026-101707
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- Record
EUVD-2026-101707- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6jj3-hxch-4xff
An administrator could retrieve the password reset code for any user and take over the account. ...
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- Record
GHSA-6jj3-hxch-4xff- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-640
- Updated
- 2026-11-02
NVD
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- Record
CVE-2026-108337- CVSS 4.0
- 7.4 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-640
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108337 is a high vulnerability (CVSS 7.4) in Hitachi Vantara Remot Ops Agent, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.