CVE-2020-26061 Auth bypass in n/a
An unauthenticated remote attacker can bypass security question validation to reset passwords for any registered user in the Passwordstate Password Reset Portal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-26061?
CVE-2020-26061 is a high-severity authentication bypass vulnerability in n/a, published on 5 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user.
Weakness: CWE-306
Which versions are affected by CVE-2020-26061?
It affects 1 product.
Products include Clickstudios Passwordstate.
How do I fix CVE-2020-26061?
No fix has been published for CVE-2020-26061 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-26061 being exploited?
There is no known exploitation of CVE-2020-26061 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2022-3875 Click Studios Passwordstate API authentication bypass by assumed-immutable data
- CVE-2020-27747 Auth bypass in n/a
- CVE-2022-25570 Missing authorization in n/a
- CVE-2018-14776 Cross-site scripting in n/a
- CVE-2022-4613 Click Studios Passwordstate Browser Extension Provisioning improper authorization
Sources
Also known as GHSA-f473-4gx3-59rw.