CVE-2026-93556

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The '/password/guardarClau/recover' endpoint accepts the usuariId parameter to specify the account for a password change. The system fails to validate the JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—against the user specified in that parameter. This allows an unauthenticated attacker to manipulate the usuariId and reset the password for any account, including administrative ones, potentially leading to full account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.