CVE-2026-108337

HighCVSS 7.4/10Last modified Oct 16, 2026

Description

An administrator could retrieve the password reset code for any user and take over the account.

The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.

An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

Metrics

CVSS 4.0 7.4/10CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-640

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-108344.6The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before movinCVE-2026-108357.7The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions CVE-2026-1083578.8PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes storedCVE-2026-1083588.8PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScannCVE-2026-1083598.7PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::proCVE-2026-108365.1Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests.CVE-2026-1083606.4PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, WorksheeCVE-2026-1083617.2Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker CVE-2026-1083629.1Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attesCVE-2026-108375.1Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated linkCVE-2026-1083727.1Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until CVE-2026-1083736.5ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wi