CWE-620 (未经验证的口令修改) — Vulnerability Class 68

CWE-620 represents a critical authentication weakness where software allows password modifications without verifying the user’s current identity. This flaw typically arises when applications accept new credentials based solely on a username or session token, bypassing the requirement for the original password or multi-factor authentication. Attackers exploit this vulnerability by intercepting valid user sessions or manipulating requests to reset passwords for other accounts, thereby gaining unauthorized access to sensitive data and elevated privileges. To mitigate this risk, developers must enforce strict verification protocols during password changes. This includes requiring the current password, implementing time-limited reset tokens sent via secure channels, and validating session integrity. By ensuring that only the legitimate account holder can authorize changes, organizations effectively prevent account takeover attacks and maintain robust user authentication standards.