Common Weakness Enumeration

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Description

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-640 ordered by modification date.

25 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-x3vp-85cm-q97r	CVE-2026-70175	HIGH	nuget/Microsoft.AspNetCore.App.Runtime.linux-arm nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64 nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64 nuget/Microsoft.AspNetCore.App.Runtime.linux-x64 nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64 nuget/Microsoft.AspNetCore.App.Runtime.osx-x64 nuget/Microsoft.AspNetCore.App.Runtime.win-arm nuget/Microsoft.AspNetCore.App.Runtime.win-arm64 nuget/Microsoft.AspNetCore.App.Runtime.win-x64 nuget/Microsoft.AspNetCore.App.Runtime.win-x86	Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability	2026-10-13
GHSA-4gv3-mc9p-5wqc	CVE-2026-18963	CRITICAL	maven/org.keycloak/keycloak-services	Keycloak: Unauthenticated account takeover via reset-credentials flow bypass	2026-08-28
GHSA-h854-c3m3-mh5v	CVE-2026-55207	HIGH	-	Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass	2026-08-28
GHSA-5c37-5j7w-8mh8	CVE-2026-50635	HIGH	-	LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.	2026-07-31
GHSA-m492-gv72-xvxj	-	LOW	-	Kimai Password Reset Link Remains Valid After Password Change	2026-07-01
GHSA-7gm6-w7mx-58cr	CVE-2026-29199	HIGH	-	phpBB has Password Reset Link Poisoning via Host Header injection	2026-06-18
GHSA-gf43-24g3-5hw2	CVE-2026-45013	HIGH	npm/apostrophe	Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation	2026-06-12
GHSA-9qv9-8xv6-5p35	CVE-2026-35676	HIGH	-	phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation	2026-05-28
GHSA-w9xh-5f39-vq89	CVE-2026-35675	HIGH	-	phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration	2026-05-28
GHSA-gv7r-3mr9-h5x8	CVE-2026-42606	HIGH	-	AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass	2026-05-13
GHSA-hp5w-3hxx-vmwf	CVE-2026-34751	CRITICAL	npm/@payloadcms/graphql npm/payload	Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery	2026-04-08
GHSA-jxq9-79vj-rgvw	CVE-2026-27593	CRITICAL	-	Statamic is vulnerable to account takeover via password reset link injection	2026-03-19
GHSA-22m3-c7vp-49fj	CVE-2026-28681	HIGH	pypi/irrd	IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links	2026-03-06
GHSA-rfjg-6m84-crj2	CVE-2026-28268	CRITICAL	golang/code.vikunja.io/api	Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse	2026-02-28
GHSA-fmr2-m7gc-577w	CVE-2026-2895	LOW	-	funadmin has Weak Password Recovery Mechanism for Forgotten Password	2026-02-26
GHSA-78wq-6gcv-w28r	CVE-2026-26273	CRITICAL	-	Known affected by Account Takeover via Password Reset Token Leakage	2026-02-13
GHSA-34cx-hvm4-vx7j	CVE-2017-18908	CRITICAL	golang/github.com/mattermost/mattermost-server	Mattermost Server password reset email requests can be sent to attacker-provided email addresses	2026-02-10
GHSA-95fv-5gfj-2r84	CVE-2025-64113	CRITICAL	nuget/MediaBrowser.Server.Core	Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition	2025-12-29
GHSA-2w46-vq8h-98vh	-	MODERATE	-	Shopware 6's password recovery link does not expire after email change	2025-11-14
GHSA-mwmh-7px9-4c23	CVE-2025-64101	HIGH	golang/github.com/zitadel/zitadel/v2	ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection	2025-11-05
GHSA-mwhf-6mjm-6w3h	CVE-2021-29038	MODERATE	maven/com.liferay.commerce/com.liferay.commerce.account.web maven/com.liferay.portal/portal-impl maven/com.liferay.portal/release.dxp.bom maven/com.liferay/com.liferay.login.web maven/com.liferay/com.liferay.users.admin.web	Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers	2025-07-29
GHSA-jfch-m2x3-2v66	CVE-2021-33321	HIGH	maven/com.liferay.portal/com.liferay.portal.impl maven/com.liferay.portal/release.portal.bom	Liferay Portal and Liferay DXP insecure default configuration	2025-06-27
GHSA-252r-f55f-ff34	CVE-2017-7615	HIGH	-	MantisBT allows arbitrary password reset	2025-04-22
GHSA-2hp9-3xfr-r9w2	CVE-2023-31287	HIGH	nuget/Serenity.Net.Core nuget/Serenity.Net.Web	Insufficient token expiration in Serenity	2025-01-31
GHSA-cq42-vhv7-xr7p	CVE-2024-1722	LOW	maven/org.keycloak/keycloak-services	Keycloak Denial of Service via account lockout	2024-12-20