CVE-2026-128331

Miniflux before 2.3.5 Password Change Without Current Password via Settings Form

Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed

Vendors

Miniflux Project

Products

Miniflux

CVE-2026-127058

WonderCMS before 3.7.0 Unverified Password Change via saveAction

WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Wondercms

Products

Wondercms

CVE-2026-107884

krb5: Unauthorized key reset of protected principal via kpasswd

In MIT krb5 release 1.15 and later, a client with kadmin administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol.

CVSS 3.1 · 6.7 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2025-71457

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Vtenext

Products

Vtenext

CVE-2013-20008

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

Wag200g

CVE-2026-119429

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyadmin

Products

Phpmyadmin

CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cheaper-inference

Products

Omniroute

CVE-2026-97380

MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Mariadb

Products

Mariadb Server

CVE-2026-112002

ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Projectsend

Products

Projectsend

CVE-2026-104106

FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Error311

Products

Filerise

CVE-2026-102603

Gotify: Insufficiently Protected Password Change endpoint

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gotify

Products

Server

CVE-2026-105785

Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Laurent 22

Products

Joplin

CVE-2026-76633

WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Labredescefetrj Wegia

Products

Wegia Wegia

CVE-2026-17599

Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sonatype

Products

Nexus Repository Manager

CVE-2026-92467

microservices-platform through 6.0.0 Unverified Password Change via /users/password

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zlt2000

Products

Microservices-platform

CVE-2026-91995

pig before 4.1.0 Unverified Password Change via /register/password

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Pig-mesh

Products

Pig

CVE-2026-46623

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-54176

backpack/crud: MyAccountController allows changing the login email without a current-password check

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Laravel-backpack

Products

Crud

CVE-2026-54175

backpack/crud: Unverified password change in MyAccountController via mass assignment

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Laravel-backpack

Products

Crud

CVE-2026-85591

phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data update endpoint with only a CSRF token to silently change any user's password, including administrators, causing irreversible account takeover and victim lockout.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq