CWE-620 Unverified Password Change
Description
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-620 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-3hcj-9m7p-wwm9 | CVE-2026-102603 | MODERATE |
Gotify: Insufficiently Protected Password Change endpoint |
2026-10-15 | |
| GHSA-8cj9-r88m-8945 | CVE-2026-73292 | HIGH |
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation |
2026-09-03 | |
| GHSA-9fw9-8c49-qch8 | CVE-2026-54176 | MODERATE | - |
Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check |
2026-08-20 |
| GHSA-xpv2-hrfc-hw62 | CVE-2026-54175 | HIGH | - |
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment |
2026-08-20 |
| GHSA-h4hf-v6w5-897x | - | HIGH | - |
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account |
2026-07-24 |
| GHSA-gf57-4mp6-m85x | CVE-2026-46623 | HIGH |
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module |
2026-06-26 | |
| GHSA-wgx6-g857-jjf7 | CVE-2026-42084 | HIGH |
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence |
2026-05-29 | |
| GHSA-x93p-w2ch-fg67 | CVE-2025-67719 | CRITICAL | - |
Ibexa User Bundle is missing password change validation |
2025-12-11 |
| GHSA-fjh6-8679-9pch | - | HIGH |
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change |
2025-11-14 | |
| GHSA-x39m-3393-3qp4 | - | HIGH |
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) |
2025-11-14 | |
| GHSA-6f58-j323-6472 | CVE-2023-5844 | MODERATE | - |
pimcore/admin-ui-classic-bundle Unverified Password Change |
2025-11-10 |
| GHSA-j527-v579-m98h | CVE-2024-2213 | LOW |
Improper authentication in zenml |
2025-10-15 | |
| GHSA-3jrg-97f3-rqh9 | CVE-2025-47938 | LOW | - |
TYPO3 Unverified Password Change for Backend Users |
2025-05-20 |
| GHSA-cc6x-8cc7-9953 | CVE-2024-51493 | MODERATE |
OctoPrint has API key access in settings without reauthentication |
2025-01-21 | |
| GHSA-39gf-864w-pxw4 | CVE-2022-2930 | MODERATE |
Unverified Password Change in OctoPrint |
2024-11-22 | |
| GHSA-93x3-m7pw-ppqm | CVE-2024-34077 | HIGH | - |
Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process |
2024-05-14 |
| GHSA-5626-pw9c-hmjr | CVE-2024-23637 | MODERATE |
OctoPrint Unverified Password Change via Access Control Settings |
2024-02-08 | |
| GHSA-9wgg-m99q-hhfc | - | HIGH |
Expired tokens can be renewed without validating the account password |
2023-12-20 |