Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-640 (忘记口令恢复机制弱) — Vulnerability Class 105

105 vulnerabilities classified as CWE-640 (忘记口令恢复机制弱). AI Chinese analysis included.

CWE-640 represents a critical authentication weakness where the password recovery process fails to adequately verify the identity of the requester. This flaw typically arises when developers implement insecure methods, such as sending passwords in plain text via email, using easily guessable security questions, or allowing unlimited reset attempts without locking mechanisms. Attackers exploit these vulnerabilities by impersonating legitimate users to bypass authentication controls, thereby gaining unauthorized access to sensitive accounts and data. To mitigate this risk, developers must enforce robust verification protocols, such as requiring multi-factor authentication or sending time-limited, cryptographically secure reset tokens to verified contact methods. By ensuring that recovery mechanisms are as secure as the initial login process, organizations can prevent account takeover attacks and maintain user trust in their security infrastructure.

MITRE CWE Description
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. It is common for an application to have a mechanism that provides a means for a user to gain access to their account in the event they forget their password. Very often the password recovery mechanism is weak, which has the effect of making it more likely that it would be possible for a person other than the legitimate system user to gain access to that user's account. Weak password recovery schemes completely undermine a strong password authentication scheme. This weakness may be that the security question is too easy to guess or find an answer to (e.g. because the question is too common, or the answers can be found using social media). Or there might be an implementation weakness in the password recovery mechanism code that may for instance trick the system into e-mailing the new password to an e-mail account other than that of the user. There might be no throttling done on the rate of password resets so that a legitimate user can be denied service by an attacker if an attacker tries to recover their password in a rapid succession. The system may send the original password to the user rather than generating a new temporary password. In summary, password recovery functionality, if not carefully designed and implemented can often become the system's weakest link that can be misused in a way that would allow an attacker to gain unau…
Common Consequences (3)
Access ControlGain Privileges or Assume Identity
An attacker could gain unauthorized access to the system by retrieving legitimate user's authentication credentials.
AvailabilityDoS: Resource Consumption (Other)
An attacker could deny service to legitimate system users by launching a brute force attack on the password recovery mechanism using user ids of legitimate users.
Integrity, OtherOther
The system's security functionality is turned against the system by the attacker.
Mitigations (5)
Architecture and DesignMake sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Architecture and DesignDo not use standard weak security questions and use several security questions.
Architecture and DesignMake sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Architecture and DesignRequire that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Architecture and DesignNever allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Examples (1)
A famous example of this type of weakness being exploited is the eBay attack. eBay always displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay password throttling would kick in and lock out the highest bidder's account for some time. An attacker could th…
CVE IDTitleCVSSSeverityPublished
CVE-2025-10127 Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password — Security Gateway 9.8 Critical2025-09-11
CVE-2025-32486 WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability — Material Dashboard 9.8 Critical2025-09-09
CVE-2025-7948 jshERP updatePwd password recovery — jshERP 4.3 Medium2025-07-22
CVE-2025-7881 Mercusys MW301R Web Interface password recovery — MW301R 2.7 Low2025-07-20
CVE-2024-43190 IBM Engineering Requirements Management DOORS weak authentication — Engineering Requirements Management DOORS 5.9 Medium2025-07-07
CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection — Natours 9.8AICriticalAI2025-07-07
CVE-2025-52560 Kanboard Password Reset Poisoning via Host Header Injection — kanboard 8.1 High2025-06-24
CVE-2025-6216 Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability — Allegra 9.8AICriticalAI2025-06-21
CVE-2025-47646 WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability — PSW Front-end Login & Registration 9.8 Critical2025-05-23
CVE-2025-31380 WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability — Paid Videochat Turnkey Site 9.8 Critical2025-04-17
CVE-2024-12295 BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password — BoomBox Theme Extensions 8.8 High2025-03-19
CVE-2025-29995 Account Takeover Vulnerability in CAP back office application — CAP back office application 8.8 -2025-03-13
CVE-2025-2093 PHPGurukul Online Library Management System change-password.php password recovery — Online Library Management System 3.1 Low2025-03-07
CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP — Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.1 High2025-02-28
CVE-2025-0331 YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery — YunzMall 5.3 Medium2025-01-09
CVE-2024-11350 AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover — AdForest 9.8 Critical2025-01-08
CVE-2024-47547 Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password — Reyee OS 9.4 Critical2024-12-06
CVE-2024-11103 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover — Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe 9.8 Critical2024-11-28
CVE-2024-45670 IBM Security SOAR weak password recovery mechanism — Security SOAR 5.6 Medium2024-11-14
CVE-2024-50356 Press has a potential 2FA bypass — press--2024-10-31
CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP — App Builder – Create Native Android & iOS Apps On The Flight 8.1 High2024-10-25
CVE-2024-9305 AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP — AppPresser – Mobile App Framework 8.1 High2024-10-16
CVE-2024-9907 QileCMS Verification Code Forget.php sendEmail password recovery — QileCMS 3.7 Low2024-10-13
CVE-2024-8878 Unauthenticated Password Reset — Netman 204 9.8AICriticalAI2024-09-24
CVE-2024-8692 TDuckCloud TDuckPro password recovery — TDuckPro 5.3 Medium2024-09-11
CVE-2024-6203 HaloITSM - Password Reset Poisoning — HaloITSM 8.3 High2024-08-06
CVE-2024-6125 Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism — OTP Login With Phone Number, OTP Verification 8.1 High2024-06-19
CVE-2023-7264 Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism — Build App Online 8.1 High2024-06-11
CVE-2024-36407 SuiteCRM unauthenticated user password reset on php7 — SuiteCRM 3.7 Low2024-06-10
CVE-2024-5277 Weak Password Recovery Mechanism in lunary-ai/lunary — lunary-ai/lunary 9.8AICriticalAI2024-06-06

Vulnerabilities classified as CWE-640 (忘记口令恢复机制弱) represent 105 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.