CVE-2026-14850

— UNSCORED

Published 2026-09-17 · Updated 2026-09-18

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

Weaknesses

CWE-640

All references

https://www.incibe.es/en/incibe-cert/notices/aviso/weak-password-recovery-mechanism-forgotten-password-mobiapparc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100870PoC
HIGHCVE-2026-101188PoC
CRITICALCVE-2026-9273
MEDIUMCVE-2026-93340PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.