CWE-640— Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.— MITRE CWE catalog
374 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-640page 6 of 8
- CVE-2021-30185HIGHCVSS 7.5EG 7.52021-04-07
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
- CVE-2020-27408HIGHCVSS 7.5EG 7.52020-12-04
OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users.
- CVE-2020-15949HIGHCVSS 7.5EG 7.52020-11-05
Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.
- CVE-2020-26061HIGHCVSS 7.5EG 7.52020-10-05
ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questio…
- CVE-2020-14015HIGHCVSS 7.5EG 7.52020-06-24
An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system w…
- CVE-2009-5025HIGHCVSS 7.5EG 7.52020-01-15
A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.
- CVE-2018-0696HIGHCVSS 7.5EG 7.52019-02-13
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
- CVE-2015-7257HIGHCVSS 7.5EG 7.52017-08-24
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username par…
- CVE-2017-7629HIGHCVSS 7.5EG 7.52017-06-15
QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.
- CVE-2017-9543HIGHCVSS 7.5EG 7.52017-06-12
register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.
- CVE-2017-7731HIGHCVSS 7.5EG 7.52017-05-27
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature.
- CVE-2016-8716HIGHCVSS 7.5EG 7.52017-04-12
An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits th…
- CVE-2017-5594HIGHCVSS 7.5EG 7.52017-01-25
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. …
- CVE-2016-2349HIGHCVSS 7.5EG 7.52016-12-21
Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.
- CVE-2016-5996HIGHCVSS 7.5EG 7.52016-09-26
The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.…
- CVE-2015-10071HIGHCVSS 2.6EG 7.52023-01-19
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. …
- CVE-2026-108337HIGHCVSS 7.4EG 7.42026-10-14
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited t…
- CVE-2026-63159HIGHCVSS 7.4EG 7.42026-10-13
Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reu…
- CVE-2026-53997HIGHCVSS 7.4EG 7.42026-10-12
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthentica…
- CVE-2026-40585HIGHCVSS 7.4EG 7.42026-04-21
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption functio…
- CVE-2023-43650HIGHCVSS 7.4EG 7.42023-09-27
JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwo…
- CVE-2023-35134HIGHCVSS 7.4EG 7.42023-07-19
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
- CVE-2022-22691HIGHCVSS 6.8EG 7.42022-01-18
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the…
- CVE-2026-125074HIGHCVSS 7.3EG 7.32026-11-09
A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password …
- CVE-2026-115973HIGHCVSS 7.3EG 7.32026-10-24
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController…
- CVE-2026-90522HIGHCVSS 7.3EG 7.32026-09-13
A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipul…
- CVE-2026-56308HIGHCVSS 7.3EG 7.32026-07-12
Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change th…
- CVE-2026-15479HIGHCVSS 7.3EG 7.32026-07-12
A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newP…
- CVE-2026-12066HIGHCVSS 7.3EG 7.32026-06-12
A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument userna…
- CVE-2020-28186HIGHCVSS 7.3EG 7.32020-12-24
Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.
- CVE-2016-7038HIGHCVSS 7.3EG 7.32017-01-20
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
- CVE-2024-12604HIGHCVSS 6.5EG 7.32025-03-10
Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misus…
- CVE-2026-32103HIGHCVSS 7.2EG 7.22026-03-11
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password …
- CVE-2026-16437HIGHCVSS 7.1EG 7.12026-10-15
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3…
- CVE-2026-61049HIGHCVSS 7.1EG 7.12026-07-21
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…
- CVE-2026-53904HIGHCVSS 7.1EG 7.12026-07-01
MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, p…
- CVE-2026-30459HIGHCVSS 7.1EG 7.12026-04-16
An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
- CVE-2025-65203HIGHCVSS 7.1EG 7.12025-12-17
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to ac…
- CVE-2025-61977HIGHCVSS 7.0EG 7.02025-10-23
A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery qu…
- CVE-2026-46347MEDIUMCVSS 6.8EG 6.82026-10-23
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and…
- CVE-2026-108737MEDIUMCVSS 6.8EG 6.82026-10-11
Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset lin…
- CVE-2026-93340MEDIUMCVSS 6.8EG 6.82026-09-21
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in t…
- CVE-2019-12476MEDIUMCVSS 6.8EG 6.82019-06-17
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client …
- CVE-2017-2614MEDIUMCVSS 6.8EG 6.82018-07-27
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accoun…
- CVE-2026-46346MEDIUMCVSS 6.5EG 6.52026-10-23
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target…
- CVE-2026-86260MEDIUMCVSS 6.5EG 6.52026-09-07
A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of t…
- CVE-2026-22723MEDIUMCVSS 6.5EG 6.52026-03-05
Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.
- CVE-2025-7948MEDIUMCVSS 6.5EG 6.52025-07-22
A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can b…
- CVE-2023-3007MEDIUMCVSS 6.5EG 6.52023-05-31
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulat…
- CVE-2021-44839MEDIUMCVSS 6.5EG 6.52022-01-18
An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/adm_utilisateur/send-mail.json endpoint, a user can send a JSON array with user …
Map vulnerabilities like CWE-640 to your infrastructure
EchelonGraph correlates every CVE — across CWE-640 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →