CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- authorizerdev authorizer Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata 8.6 High
- seppmail ag secure email gateway (seg) Empty initial password permits GINA account takeover 8.3 High
- zitadel ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection 8.6 High
- maccmspro maccms10 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code 9.3 Critical
- havelsan liman mys Host Header Injection in HAVELSAN's Liman MYS 8.1 High
- faveosuite faveo helpdesk FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery 6.9 Medium
- open-reception appointment-booking-software OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` 8.3 High
- intranda goobi-viewer-core Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset 6.8 Medium
- intranda goobi-viewer-core Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset 6.5 Medium
- part-db part-db-server Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover 8.7 High
- advantech adam-3600 A vulnerability in the password reset mechanism could allow an attacker to bypass the... 9.2 Critical
- aircheng-org iwebshop-5 aircheng-org iWebShop-5 simple.php send_message_mobile password recovery 5.3 Medium
- mitsubishi electric corporation analytix, bizviz, genesis +7 more +9 more An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz 7.1 High
- mitsubishi electric corporation analytix, bizviz, genesis +7 more +9 more An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz 9.2 Critical
- hitachi vantara remot ops agent Password Reset Code Accessible in User Listing API 7.4 High
- hitachi vantara remote ops agent Password Reset Functionality Missing Brute-Force Protection 9.1 Critical
- omnispace agora project Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover 9.1 Critical
- microsoft asp.net core 10.0, asp.net core 8.0, asp.net core 9.0 +2 more +4 more ASP.NET Core Elevation of Privilege Vulnerability 8.1 High
- netherman portal del hermano (portaldelhermano.es) Netherman Portal del Hermano Account Takeover via Password Reset Oracle 9.1 Critical
- logicaldoc community edition LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket 5.3 Medium
- traccar Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion 7.6 High
- integrics enswitch Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API 9.3 Critical
- akin software computer import-export industry and trade co. ltd. myrezzta Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta 9.1 Critical
- laurent22 joplin Joplin Server password reset accepts tokens issued for unrelated purposes 4.8 Medium
- getsimplecms-ce GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover 9.1 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Authentication Bypass in the Password Reset Workflow 9.8 Critical
- netcore power13 Netcore POWER13 ubus routerd.passwd_set password recovery 6.9 Medium
- sylius Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header 8.7 High
- gladys assistant assistant Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint 7.4 High
- alinto sogo SOGo before 5.12.11 Password Reset Token Interception via Origin Header 8.7 High
- mobiapparc Weak password recovery mechanism for forgotten password in MobiAPParc 8.8 High
- jaychouchannel tourism-management-system jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery 6.9 Medium
- concrete cms cms Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another. 6.3 Medium
- ankaref innovation and technology inc. librid/libref Improper Authentication in Ankaref's LIBRID/LIBREF 7.5 High
- sfturing hosp order sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change 6.9 Medium
- No product listed An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the... 9.8 Critical
- team password manager password manager Team Password Manager before 14.184.308 Authentication Bypass in Password Reset 9.3 Critical
- beetel 450tc3 Beetel 450TC3 password recovery 5.3 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure 9.8 Critical
- 101gen automation web platform – notifications and otp for woocommerce, advanced country code Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure 9.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.15, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass 9.1 Critical
- abeverley dancer2::plugin::auth::extensible Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send 9.8 Critical
- wishlist member member Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter 9.8 Critical
- budibase Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email 8.6 High
- scriptsbundle nokri WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability 9.8 Critical
- miniorange otp verification WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability 9.8 Critical
- zohocorp manageengine ddi central Authentication Bypass Leading to Account Takeover 9.8 Critical
- macrozheng mall macrozheng mall mall-portal getAuthCode password recovery 6.3 Medium
- themetechmount truebooker – appointment booking and scheduler system TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' 9.8 Critical
- stellarwp membership plugin – kadence memberships Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover 9.3 Critical
- Show olderLoading…