CVE-2020-27422

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker version 1.19.23.5311

Description The password reset link emailed to the user does not expire once used, allowing an attacker to use the same link to take over the account.

Recommendations For Anuko Time Tracker version 1.19.23.5311, consider implementing a mechanism to expire the password reset link after its first use to prevent account takeover. As a temporary workaround, restrict access to password reset functionality until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.