CVE-2026-28213CWE-200CWE-640

EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

Critical · published February 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00543 · 44.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-02-26T22:31Z
EPSS history
Timeline
  • 26 FEB 22:31Z
    EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
    cvelistv5