CVE-2026-73431

Name of the Vulnerable Software and Affected Versions Vulnerability-Lookup (affected versions not specified)

Description An authentication weakness exists in the account activation and password-recovery mechanism. The system uses stateless signed tokens containing only the user's login. While the signature and age are validated, the application fails to track if a token has already been used. Consequently, a captured activation or recovery link remains valid for the duration of the TOKEN VALIDITY PERIOD, even after a password change. This allows an attacker with a valid token to replay it multiple times to reset the password and take control of the account. Furthermore, tokens are not bound to a specific purpose, enabling the same token to be used for both activation and recovery workflows. Exploitation requires obtaining a valid link but does not require the victim's current password or an active session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.