CWE-640 · Weak Password Recovery Mechanism for Forgotten Password

309 CVEs classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). Browse by severity and year.

Top CVEs for CWE-640
CVESeverityScorePublishedSummary
CVE-2025-4320Critical10.02026-01-23Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutio…
CVE-2025-63314Critical10.02026-01-12A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and…
CVE-2023-7028Critical10.02024-01-12An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5…
CVE-2026-12949Critical9.82026-08-14The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3…
CVE-2026-66691Critical9.82026-08-13Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2026-61967Critical9.82026-08-13Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
CVE-2026-12571Critical9.82026-08-11An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
CVE-2026-14364Critical9.82026-08-07The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all…
CVE-2026-13019Critical9.82026-07-07Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a re…
CVE-2026-37106Critical9.82026-06-30An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disput…
CVE-2026-12417Critical9.82026-06-24The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up t…
CVE-2026-12416Critical9.82026-06-24The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the…
CVE-2026-11551Critical9.82026-06-20The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plu…
CVE-2026-32865Critical9.82026-03-19OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswo…
CVE-2026-28268Critical9.82026-02-27Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan…
CVE-2026-28213Critical9.82026-02-26EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a targe…
CVE-2026-26273Critical9.82026-02-13Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks…
CVE-2022-50910Critical9.82026-01-13Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requ…
CVE-2025-64113Critical9.82025-12-09Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S…
CVE-2025-50433Critical9.82025-11-26An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary us…
All CVEs classified under CWE-640 — newest first (page 1 of 4)
CVESeverityScorePublishedSummary
CVE-2026-12949Critical9.82026-08-14The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3…
CVE-2026-72856High8.12026-08-13Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On…
CVE-2026-66691Critical9.82026-08-13Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2026-61967Critical9.82026-08-13Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
CVE-2026-12571Critical9.82026-08-11An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
CVE-2026-727722026-08-11n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was ma…
CVE-2026-19361Low3.72026-08-09A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Exe…
CVE-2026-14364Critical9.82026-08-07The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all…
CVE-2026-9273Critical9.32026-08-05The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account…
CVE-2026-183632026-07-30A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password rese…
CVE-2026-64635Medium5.32026-07-30Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control th…
CVE-2026-62517Medium5.32026-07-21Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar…
CVE-2026-62486Medium5.02026-07-21Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar…
CVE-2026-61181High7.62026-07-21Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The suppor…
CVE-2026-61143Medium6.42026-07-21Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are a…
CVE-2026-61049High7.12026-07-21Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar…
CVE-2026-60658High7.52026-07-21Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1…
CVE-2026-60650High8.02026-07-21Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar…
CVE-2026-60648High8.02026-07-21Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar…
CVE-2026-60646High8.02026-07-21Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar…
CVE-2026-53595Critical9.42026-07-20FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invi…
CVE-2026-56308High7.32026-07-12Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attac…
CVE-2026-15479High7.32026-07-12A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Adm…
CVE-2026-15155High8.82026-07-11The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Heade…
CVE-2026-7655High8.12026-07-11The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin…
CVE-2026-55207High8.82026-07-09Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username c…
CVE-2026-13020High8.12026-07-07A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote…
CVE-2026-13019Critical9.82026-07-07Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a re…
CVE-2026-34198Medium5.32026-07-07Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts…
CVE-2026-536462026-07-06FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists fo…
CVE-2026-53904High7.12026-07-01MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previous…
CVE-2026-37106Critical9.82026-06-30An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disput…
CVE-2026-12417Critical9.82026-06-24The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up t…
CVE-2026-12416Critical9.82026-06-24The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the…
CVE-2026-11551Critical9.82026-06-20The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plu…
CVE-2026-56081Critical9.12026-06-19Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before tha…
CVE-2026-46894High8.02026-06-17Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.1…
CVE-2026-45013High8.12026-06-12ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL…
CVE-2026-12066High7.32026-06-12A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberControlle…
CVE-2026-50635High8.82026-06-09LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that wo…
CVE-2026-10169Low3.72026-05-31A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vuln…
CVE-2026-7459High7.52026-05-30The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions…
CVE-2026-35676High8.22026-05-28phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account…
CVE-2026-9609Medium4.72026-05-27A vulnerability was identified in QianFox FoxCMS up to 1.2.6. This affects the function Edit of the file Admin.php. The manipulation leads to weak password rec…
CVE-2026-9466Medium5.32026-05-25A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0. This issue affects some unknown processing of the file /rest/user/updateU…
CVE-2026-36438Medium5.32026-05-18An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under…
CVE-2026-42606High8.12026-05-09AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-su…
CVE-2026-7652Medium5.32026-05-09The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions…
CVE-2026-34408Critical9.12026-05-05An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrar…
CVE-2026-29199High8.12026-05-04phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostn…
CVE-2026-7554Medium5.62026-05-01A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation…
CVE-2026-40585High7.42026-04-21blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and store…
CVE-2026-24467Critical9.02026-04-20OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0…
CVE-2025-36579Medium5.12026-04-16Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could poten…
CVE-2026-30459High7.12026-04-16An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user…
CVE-2026-33707Critical9.42026-04-10Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no…
CVE-2026-34751Critical9.12026-04-01Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the passwo…
CVE-2026-4136Medium4.32026-03-20The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due t…
CVE-2026-32865Critical9.82026-03-19OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswo…
CVE-2026-32103Medium6.82026-03-11StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endp…
CVE-2025-69614Critical9.42026-03-10Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Pr…
CVE-2026-28681High8.12026-03-06Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and…
CVE-2026-22723Medium6.52026-03-05Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfo…
CVE-2026-28268Critical9.82026-02-27Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechan…
CVE-2026-28213Critical9.82026-02-26EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a targe…
CVE-2026-27593Critical9.32026-02-24Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the pa…
CVE-2026-2895Low3.72026-02-21A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php…
CVE-2026-2564High8.12026-02-16A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /Outsi…
CVE-2026-2543Low2.72026-02-16A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Passw…
CVE-2026-26273Critical9.82026-02-13Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks…
CVE-2020-37172Medium5.32026-02-11AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha…
CVE-2020-37158Medium5.32026-02-11AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha…
CVE-2026-25858Critical9.12026-02-07macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated atta…
CVE-2025-4320Critical10.02026-01-23Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutio…
CVE-2025-4319Critical9.42026-01-23Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Te…
CVE-2026-1325Medium5.32026-01-22A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of th…
CVE-2022-50910Critical9.82026-01-13Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requ…
CVE-2025-63314Critical10.02026-01-12A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and…
CVE-2025-15398Low3.72025-12-31A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthControll…
CVE-2025-14783Medium4.32025-12-31The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient…
CVE-2023-53958High7.52025-12-19LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation…
CVE-2025-65203High7.12025-12-17KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attrib…
CVE-2025-14696Medium5.32025-12-15A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this vulnerability is an unkno…
CVE-2025-64113Critical9.82025-12-09Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S…
CVE-2025-53704High7.52025-12-04The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.
CVE-2024-32642High8.82025-12-03Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows…
CVE-2025-66225High8.82025-11-29OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su…
CVE-2025-50433Critical9.82025-11-26An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary us…
CVE-2025-13565Medium5.32025-11-23A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPass…
CVE-2025-62709Medium6.82025-11-20ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build…
CVE-2025-62406High8.12025-11-18Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-rese…
CVE-2025-8855High8.12025-11-14Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln…
CVE-2025-12866Critical9.82025-11-10EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the…
CVE-2025-64101High8.12025-10-29Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mecha…
CVE-2025-61977High7.02025-10-23A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allo…
CVE-2025-56748Medium6.42025-10-15Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brut…
CVE-2025-41251High8.12025-09-29VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potenti…
CVE-2025-10322Medium5.32025-09-12A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the arg…
CVE-2025-10127Critical9.82025-09-11Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypa…
CVE-2025-32486Critical9.82025-09-09Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: f…