CVE-2026-90522 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery
Weak password recovery in Tourism-Management-System allows remote attackers to bypass authentication and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90522?
CVE-2026-90522 is a medium-severity authentication bypass vulnerability in jaychouchannel Tourism-Management-System, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.
Weakness: CWE-640
Which versions are affected by CVE-2026-90522?
How do I fix CVE-2026-90522?
No fix has been published for CVE-2026-90522 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-90522 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90522 exists.
Sources
Also known as GHSA-fmmj-7xf2-h688.