{"id":"CVE-2026-34408","aliases":["EUVD-2026-27323","GHSA-338p-fcwm-8fgc"],"status":"published","title":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0...","description":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00256,"percentile":0.17385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-640"],"published":"2026-05-05T00:00:00Z","modified":"2026-06-17T10:39:01Z","references":[{"url":"https://www.gambio.de/forum/threads/wichtiges-security-update-2024-02-v1-0-fuer-gx4-v4-0-0-0-bis-v4-9-2-0.50896/"},{"url":"https://herolab.usd.de/security-advisories/usd-2024-0002/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34408"},{"url":"https://herolab.usd.de/security-advisories/usd-2024-0002"},{"url":"https://www.gambio.de/forum/threads/wichtiges-security-update-2024-02-v1-0-fuer-gx4-v4-0-0-0-bis-v4-9-2-0.50896"},{"url":"https://github.com/advisories/GHSA-338p-fcwm-8fgc"}],"sources":{"cve":[{"id":"CVE-2026-34408","description":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-05-06T17:35:30.322Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-27323","description":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.","status":"published","published":"2026-05-05T00:00:00Z","modified":"2026-05-06T17:35:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:05:16.191098Z"}],"ghsa":[{"id":"GHSA-338p-fcwm-8fgc","title":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0...","description":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.","status":"published","published":"2026-05-05T15:31:36Z","modified":"2026-05-06T18:31:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2026-34408","description":"An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.","status":"published","published":"2026-05-05T14:16:08.623Z","modified":"2026-06-17T10:39:01.527Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:12:17.022502Z"}]}}