CVE-2025-56676 Auth bypass in n/a
Attackers can take over any user account by exploiting improper token validation in the password reset mechanism of Zender.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-56676?
CVE-2025-56676 is a medium-severity authentication bypass vulnerability in n/a, published on 30 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.
Weakness: CWE-1259
Which versions are affected by CVE-2025-56676?
It affects 1 product.
Products include Titansystems Zender.
How do I fix CVE-2025-56676?
No fix has been published for CVE-2025-56676 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-56676 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56676 exists.
Sources
Also known as GHSA-vgh5-4jjp-4pmh.