CVE-2026-18468

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2

Description An issue exists where the password reset verification state is not bound to the account being reset or the party completing the verification. Instead, the state is keyed on a value controlled by the client, specifically a client-supplied address header. This allows unauthenticated attackers to take over the account of any user, including administrators, who has recently completed a reset verification.

Recommendations Update Login & Register Forms to version 4.0.2 or later.