OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-14850

HIGH · CVSS 8.8 EPSS 0.29%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The vulnerability in the password reset functionality allows attackers to exploit improper validation of the user_id parameter, enabling unauthorized password resets for any user. This poses a significant risk of account takeover, as attackers can gain access without verifying ownership. Organizations with systems utilizing this functionality should prioritize remediation to protect user accounts from unauthorized access.

CVE
CVE-2026-14850
Severity
HIGH
CVSS
8.8
EPSS
0.29%

Original NVD Description

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.