CVE-2026-110770
Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
Affected versions
- databasus databasus
From 3.7.0 · through 3.61.0