CWEweakness
CWE-640 Weak Password Recovery Mechanism for Forgotten Password
High
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Likelihood of exploit
- High
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Common consequences
• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — Weak password recovery schemes completely undermine a strong password authentication scheme. An attacker could gain unauthorized access to the system by retrieving a legitimate user's authentication credentials.
• Availability: DoS: Resource Consumption (Other) — An attacker could deny service to legitimate system users by launching a brute force attack on the password recovery mechanism using user ids of legitimate users.
• Integrity, Other: Other — The system's security functionality is turned against the system by the attacker.
Potential mitigations
• [Architecture and Design] Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
• [Architecture and Design] Do not use standard weak security questions and use several security questions.
• [Architecture and Design] Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
• [Architecture and Design] Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
• [Architecture and Design] Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
• [Architecture and Design] Assign a new temporary password rather than revealing the original password.
Observed examples
• CVE-2025-1570: password reset functionality for a WordPress plugin allows a brute force attack of the one-time password
• CVE-2024-9302: password reset functionality for a WordPress plugin allows a brute force attack of the one-time password
• CVE-2024-5277: password recovery mechanism for AI developer toolkit does not invalidate the reset password token after it is used, allowing attackers to reuse the token to change passwords of victims
• CVE-2024-38287: web conference product resets passwords to random 8-digit values, allowing brute force attacks by retrieving the hash
Related
Attack pattern · CAPEC (1)
- CAPEC-50 Password Recovery Exploitation attack pattern
Observed example · CVE (4)
- CVE-2025-1570 The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege… vulnerability
- CVE-2024-9302 The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account… vulnerability
- CVE-2024-38287 The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers… vulnerability
- CVE-2024-5277 In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not… vulnerability
Referenced by CAPEC · weakness (1)
- CAPEC-50 Password Recovery Exploitation attack pattern
Referenced by CVE · weakness (351)
- CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to… vulnerability
- CVE-2026-116214 MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any… vulnerability
- CVE-2026-94380 Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. vulnerability
- CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. vulnerability
- CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
- CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
- CVE-2026-58202 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. vulnerability
- CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. vulnerability
- CVE-2026-43845 A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. vulnerability
- CVE-2026-112035 A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. vulnerability
- CVE-2026-16436 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64… vulnerability
- CVE-2026-16437 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64… vulnerability
- CVE-2026-108335 When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force… vulnerability
- CVE-2026-108337 An administrator could retrieve the password reset code for any user and take over the account. vulnerability
- CVE-2026-63159 Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to… vulnerability
- CVE-2026-70175 Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. vulnerability
- CVE-2026-109204 LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind… vulnerability
- CVE-2026-53997 Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its… vulnerability
- CVE-2026-108737 Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session… vulnerability
- CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows… vulnerability
- CVE-2026-19218 Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. vulnerability
- CVE-2026-105785 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. vulnerability
- CVE-2026-53953 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. vulnerability
- CVE-2026-102115 Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. vulnerability
- CVE-2026-101188 A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. vulnerability
- CVE-2026-100870 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header… vulnerability
- CVE-2026-93340 Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain… vulnerability
- CVE-2026-93453 SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated… vulnerability
- CVE-2026-14850 The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. vulnerability
- CVE-2026-90522 A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. vulnerability