Kjcao

**Name of the Vulnerable Software and Affected Versions** Nexus Repository 3 (affected versions not specified) **Description** An endpoint used to change the administrator account password during initial onboarding fails to verify if the onboarding process is still active, relying only on a local onboarding artifact. This allows an account with the `nexus:*` permission to invoke the endpoint outside the intended flow to replace the administrator password. Additionally, existing sessions are not invalidated after the password is changed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.