CVE-2026-110770
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-307
Impact
Unauthenticated remote attackers can take over arbitrary accounts, including admins, by brute-forcing six-digit password reset tokens. All an attacker needs is network access to the API and a target user's email address.
Root cause
The password reset verification endpoint lacks rate limiting, account lockout mechanisms, and code invalidation on failed attempts.
Affected systems
Databasus 3.7.0 through 3.61.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a version newer than 3.61.0 once available. If patching must wait, block or rate-limit requests to POST /api/v1/users/reset-password at your reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
References
- https://github.com/databasus/databasus
- https://github.com/databasus/databasus/blob/9ee25ed8f47b1b537468417e1bb52ed2d76218a0/backend/internal/features/users/services/user_services.go#L637
- https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force
- https://www.vulncheck.com/advisories/databasus-3.7.0-through-3.61.0-account-takeover-via-password-reset-brute-force