PT-2026-130644

CVE-2026-113616

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions LogixFast Auth versions prior to 1.0.4
Description An issue in the password reset process allows unauthenticated attackers to take over any account, including those with administrator privileges. The plugin fails to send the one-time password-reset code to the email address associated with the account, instead sending it to the email address provided in the request.
Recommendations Update to version 1.0.4.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-269: Improper Privilege Management
Related identifiers
CVE-2026-113616
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com