CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
472 vulnerabilities reference this CWE, most recent first.
GHSA-FCMX-4FPP-MG5Q
Vulnerability from github – Published: 2025-11-23 21:30 – Updated: 2025-11-23 21:30A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
{
"affected": [],
"aliases": [
"CVE-2025-13565"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-23T19:15:46Z",
"severity": "MODERATE"
},
"details": "A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.",
"id": "GHSA-fcmx-4fpp-mg5q",
"modified": "2025-11-23T21:30:32Z",
"published": "2025-11-23T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13565"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.333329"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.333329"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.697984"
},
{
"type": "WEB",
"url": "https://www.notion.so/Unauthenticated-Password-Reset-Vulnerability-in-SourceCodester-Inventory-Management-System-2b023917db8c8001b5ecf4c50a54dfbd?source=copy_link"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FCV8-P4GW-6X4X
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.
{
"affected": [],
"aliases": [
"CVE-2020-27179"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-27T05:15:00Z",
"severity": "CRITICAL"
},
"details": "konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.",
"id": "GHSA-fcv8-p4gw-6x4x",
"modified": "2022-05-24T17:32:35Z",
"published": "2022-05-24T17:32:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27179"
},
{
"type": "WEB",
"url": "https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Oct/28"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FGMJ-4XC2-M385
Vulnerability from github – Published: 2022-05-17 02:56 – Updated: 2022-05-17 02:56EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise the affected system.
{
"affected": [],
"aliases": [
"CVE-2017-2766"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-03T07:59:00Z",
"severity": "CRITICAL"
},
"details": "EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise the affected system.",
"id": "GHSA-fgmj-4xc2-m385",
"modified": "2022-05-17T02:56:02Z",
"published": "2022-05-17T02:56:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2766"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/540077/30/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95893"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FJ36-8FJ3-C7Q3
Vulnerability from github – Published: 2021-11-20 00:00 – Updated: 2021-11-23 00:00Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.
{
"affected": [],
"aliases": [
"CVE-2021-44037"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-19T17:15:00Z",
"severity": "HIGH"
},
"details": "Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.",
"id": "GHSA-fj36-8fj3-c7q3",
"modified": "2021-11-23T00:00:54Z",
"published": "2021-11-20T00:00:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44037"
},
{
"type": "WEB",
"url": "https://teampasswordmanager.com/docs/changelog/#10.135.236"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-060.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FJ69-P8F6-Q97H
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2024-02-28 18:38With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions prior to 2.2.5 and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.cloudfoundry.identity:cloudfoundry-identity-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-3189"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-28T18:38:31Z",
"nvd_published_at": "2017-05-25T17:29:00Z",
"severity": "LOW"
},
"details": "With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions prior to 2.2.5 and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.",
"id": "GHSA-fj69-p8f6-q97h",
"modified": "2024-02-28T18:38:31Z",
"published": "2022-05-13T01:07:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3189"
},
{
"type": "WEB",
"url": "https://github.com/cloudfoundry/uaa/commit/a79b89f6e4f66626914b029b7a15a423491f8013"
},
{
"type": "PACKAGE",
"url": "https://github.com/cloudfoundry/uaa"
},
{
"type": "WEB",
"url": "https://github.com/cloudfoundry/uaa/commits/2.2.5"
},
{
"type": "WEB",
"url": "https://github.com/cloudfoundry/uaa/compare/2.2.4...2.2.5"
},
{
"type": "WEB",
"url": "https://github.com/cloudfoundry/uaa/compare/2.2.5...2.2.6"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2015-3189"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password"
}
GHSA-FMMJ-7XF2-H688
Vulnerability from github – Published: 2026-09-13 15:30 – Updated: 2026-09-13 15:30A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.
{
"affected": [],
"aliases": [
"CVE-2026-90522"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-13T13:16:29Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.",
"id": "GHSA-fmmj-7xf2-h688",
"modified": "2026-09-13T15:30:21Z",
"published": "2026-09-13T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90522"
},
{
"type": "WEB",
"url": "https://github.com/jaychouchannel/Tourism-Management-System/issues/13"
},
{
"type": "WEB",
"url": "https://github.com/jaychouchannel/Tourism-Management-System/commit/9cb6215ac871f99a90cde763cf003e95ff282283"
},
{
"type": "WEB",
"url": "https://github.com/jaychouchannel/Tourism-Management-System"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90522"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/912236"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403112"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403112/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FMR2-M7GC-577W
Vulnerability from github – Published: 2026-02-22 00:31 – Updated: 2026-02-26 15:31A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "funadmin/funadmin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.1.0-rc4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-2895"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-26T15:31:41Z",
"nvd_published_at": "2026-02-21T23:15:59Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fmr2-m7gc-577w",
"modified": "2026-02-26T15:31:41Z",
"published": "2026-02-22T00:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2895"
},
{
"type": "WEB",
"url": "https://github.com/I4m6da/CVE/issues/2"
},
{
"type": "PACKAGE",
"url": "https://github.com/funadmin/funadmin"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.347206"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.347206"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.753971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "funadmin has Weak Password Recovery Mechanism for Forgotten Password"
}
GHSA-FPR8-H6HW-956C
Vulnerability from github – Published: 2026-09-29 00:31 – Updated: 2026-09-29 00:31A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-101188"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-28T22:17:31Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fpr8-h6hw-956c",
"modified": "2026-09-29T00:31:36Z",
"published": "2026-09-29T00:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101188"
},
{
"type": "WEB",
"url": "https://github.com/l22Heart/cve_report/blob/main/Netcore_POWER13_Unauthenticated_routerd_passwd_set_Password_Reset_Vulnerability.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-101188"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/906532"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/411009"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/411009/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FQC6-Q4RQ-Q3M4
Vulnerability from github – Published: 2023-06-23 18:30 – Updated: 2024-04-04 05:07This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5, tvOS 16.5. An app firewall setting may not take effect after exiting the Settings app
{
"affected": [],
"aliases": [
"CVE-2023-28202"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-23T18:15:11Z",
"severity": "MODERATE"
},
"details": "This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4, watchOS 9.5, tvOS 16.5. An app firewall setting may not take effect after exiting the Settings app",
"id": "GHSA-fqc6-q4rq-q3m4",
"modified": "2024-04-04T05:07:20Z",
"published": "2023-06-23T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28202"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213757"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213758"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213761"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213764"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FR7C-JV5V-7Q4H
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2017-8613"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-29T13:29:00Z",
"severity": "HIGH"
},
"details": "Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka \"Azure AD Connect Elevation of Privilege Vulnerability.\"",
"id": "GHSA-fr7c-jv5v-7q4h",
"modified": "2022-05-13T01:47:39Z",
"published": "2022-05-13T01:47:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8613"
},
{
"type": "WEB",
"url": "https://technet.microsoft.com/library/security/4033453"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99294"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.