Pulatjonov Jasurbek

**Name of the Vulnerable Software and Affected Versions** Gladys Assistant versions prior to 5.1.0 **Description** An issue exists where unauthenticated remote attackers can obtain valid password reset tokens for any account. This occurs due to a lack of server-side validation of the client-supplied `origin` parameter in the `forgot password` endpoint. By sending a crafted request with an attacker-controlled origin, the victim receives a poisoned reset link that discloses the session token to the attacker, potentially leading to full account takeover, including administrator accounts. **Recommendations** Update Gladys Assistant to version 5.1.0 or later. As a temporary mitigation, restrict access to the `forgot password` endpoint or avoid using the `origin` parameter until the update is applied.