CVE-2026-94412
8.8 HIGHpublic exploit availablePublished 2026-09-21 · Updated 2026-09-22
AI risk analysis
- Summary
- This vulnerability allows authenticated users to reset any other user's password, enabling unauthorized access to accounts, including administrative ones.
- Exploitability
- Exploitation is relatively straightforward as it requires an authenticated user to submit a request with an arbitrary target user ID. Precondition is the attacker must already have valid credentials.
- Blast radius
- If exploited, this could lead to unauthorized access to sensitive user accounts, potentially compromising the entire system, including administrative accounts.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to jshERP 3.7 or later.
auth-bypasswebpassword-reset
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-862
Public exploit & PoC references
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-02-user-resetpwd-account-takeover.py
- https://github.com/jishenghua/jshERP
- https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserController.java#L230-L244
- https://www.vulncheck.com/advisories/jsherp-through-3.6-authorization-bypass-via-resetpwd
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.