CVE-2026-93556CWE-639

CVE-2026-93556

published September 22, 2026

CVSS
9.3
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00305 · 22.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-22T13:17Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/direct-references-unsafe-objects-idor-tankuam-places-kompini · [email protected]
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 22 SEP 08:57Z
    Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini
    cvelistv5