CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
Attackers can take over customer accounts by extracting password reset tokens exposed in API responses during forgot password requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28213?
CVE-2026-28213 is a critical vulnerability in evershopcommerce evershop, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
Which versions are affected by CVE-2026-28213?
It affects 1 product.
Products include Evershop Evershop.
How do I fix CVE-2026-28213?
No fix has been published for CVE-2026-28213 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28213 being exploited?
There is no known exploitation of CVE-2026-28213 in the wild and no public exploit code.
Other vulnerabilities in evershopcommerce evershop
- CVE-2023-46498 Code execution in evershop
- CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
- CVE-2023-46943 EverShop at risk to unauthorized access via weak HMAC secret
- CVE-2023-46496 Directory Traversal in evershop
- CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
Sources
Also known as GHSA-cg73-g723-39jw.