CVE-2026-110770
CVE-2026-110770 · Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
CVSS 9.2 · Crítica · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
databasus
- Versiones
- ≥ 3.7.0, ≤ 3.61.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force
- https://github.com/databasus/databasus/blob/9ee25ed8f47b1b537468417e1bb52ed2d76218a0/backend/internal/features/users/services/user_services.go#L637
- https://github.com/databasus/databasus
- https://www.vulncheck.com/advisories/databasus-3.7.0-through-3.61.0-account-takeover-via-password-reset-brute-force
- https://nvd.nist.gov/vuln/detail/CVE-2026-110770