CWEweakness
CWE-620 Unverified Password Change
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Common consequences
• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Potential mitigations
• [Architecture and Design] When prompting for a password change, force the user to provide the original password in addition to the new password.
• [Architecture and Design] Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
Observed examples
• CVE-2025-4903: Router web interface allows unverified password change
• CVE-2007-0681: Web app allows remote attackers to change the passwords of arbitrary users without providing the original password, and possibly perform other unauthorized actions.
• CVE-2000-0944: Web application password change utility doesn't check the original password.
Related
Observed example · CVE (3)
- CVE-2025-4903 A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). vulnerability
- CVE-2007-0681 profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without providing the original… vulnerability
- CVE-2000-0944 CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation,… vulnerability
Child of · CWE (1)
- CWE-1390 Weak Authentication weakness
Referenced by CVE · weakness (107)
- CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys… vulnerability
- CVE-2013-20008 Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password… vulnerability
- CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of… vulnerability
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. vulnerability
- CVE-2026-104106 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. vulnerability
- CVE-2026-102603 Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. vulnerability
- CVE-2026-105785 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. vulnerability
- CVE-2026-92467 zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that… vulnerability
- CVE-2026-46623 Open Access Management (OpenAM) is an access management solution. vulnerability
- CVE-2026-91995 pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are… vulnerability
- CVE-2026-54175 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build… vulnerability
- CVE-2026-54176 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build… vulnerability
- CVE-2026-86260 A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. vulnerability
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows… vulnerability
- CVE-2026-76633 WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change… vulnerability
- CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition. vulnerability
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. vulnerability
- CVE-2026-17599 Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. vulnerability
- CVE-2026-15964 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions… vulnerability
- CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. vulnerability
- CVE-2026-56305 Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user… vulnerability
- CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions <… vulnerability
- CVE-2026-44733 OpenProject is open-source, web-based project management software. vulnerability
- CVE-2025-71328 Flowise before 3.0.10 contains an unverified password change vulnerability. vulnerability
- CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. vulnerability
- CVE-2026-5386 The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. vulnerability
- CVE-2026-9249 Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a… vulnerability
- CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. vulnerability
- CVE-2026-42084 OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. vulnerability
- CVE-2026-40588 blueprintUE is a tool to help Unreal Engine developers. vulnerability