Critical · published January 12, 2026
🚨 A static password reset token is leaving the door wide open! This critical vulnerability in DDSN Interactive Acora CMS v10.7.1 means a crafty attacker could reset user passwords at will! 🔥 Think of it like having a spare key for a house that everyone knows about — the moment someone gets their hands on it, they can stroll right in without knocking. This token acts as that notorious spare key, ready for a replay attack! If exploited, an attacker could seize control of any account connected to the CMS, resetting passwords and locking users out, leading to potential data breaches and trust issues. Imagine the chaos as sensitive information tumbles into unauthorized hands, leaving your organization's reputation in shambles!
Think of it like having a spare key for a house that everyone knows about — the moment someone gets their hands on it, they can stroll right in without knocking. This token acts as that notorious spare key, ready for a replay attack! This vulnerability arises from a static password reset token used in the password reset function, which allows attackers to reset any user's password through a replay attack, effectively taking over the account without any authentication.
If exploited, an attacker could seize control of any account connected to the CMS, resetting passwords and locking users out, leading to potential data breaches and trust issues. Imagine the chaos as sensitive information tumbles into unauthorized hands, leaving your organization's reputation in shambles! Urgently patch your installation to version 10.7.2, where this vulnerability is resolved. Additionally, consider implementing dynamic password reset tokens that expire after use to bolster security. Regularly review and update your security practices! You've got this! With these steps, you'll tighten up your security and keep those pesky intruders at bay! 🛡️