CVE-2023-26770 Auth bypass in n/a
Unauthenticated attackers can change any registered user's password by exploiting missing Cookie validation in TaskCafe.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26770?
CVE-2023-26770 is a critical authentication bypass vulnerability in n/a, published on 4 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.
Weakness: CWE-284
Which versions are affected by CVE-2023-26770?
It affects 1 product.
Products include Taskcafe Project Taskcafe.
How do I fix CVE-2023-26770?
No fix has been published for CVE-2023-26770 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-26770 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26770 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gv59-h7rc-cxvr.