CVE-2026-93556

CriticalCVSS 9.3/10Last modified Sep 22, 2026

Description

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-935587.5A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTPCVE-2026-935597.3A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown funcCVE-2026-93567.3A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the fiCVE-2026-935607.5A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceediCVE-2026-935616.5A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as siCVE-2026-935626.5A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to performCVE-2026-935637.5A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP serveCVE-2026-935647.5A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send CVE-2026-935657.5A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in CVE-2026-935666.5A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control charactersCVE-2026-935677.5A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header CVE-2026-935687.5A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT
CVE-2026-93556: Critical severity, CVSS 9.3 | Vulnix