CVE-2026-108337
Description
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Is your site exposed to CVE-2026-108337?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-108337? +
How do I check if I'm vulnerable to CVE-2026-108337? +
Related Vulnerabilities
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. …
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker …
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An …
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server …
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and …
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already …
