CVE-2026-104468

4.8 MEDIUMpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-613

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-non-expiring-password-reset-tokens-via-lostpasswordaction
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-8122
MEDIUMCVE-2025-71435PoC
MEDIUMCVE-2026-100502PoC
MEDIUMCVE-2026-100554PoC
MEDIUMCVE-2026-100624PoC
HIGHCVE-2026-100711PoC
UNSCOREDCVE-2026-101271
MEDIUMCVE-2026-102367PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.