CVE-2026-108337
— UNSCOREDPublished 2026-10-14 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Weaknesses
CWE-640
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100870PoC
- HIGHCVE-2026-101188PoC
- CRITICALCVE-2026-102115PoC
- MEDIUMCVE-2026-105785PoC
- CRITICALCVE-2026-107640
- UNSCOREDCVE-2026-108335
- MEDIUMCVE-2026-108737PoC
- MEDIUMCVE-2026-109204PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.