SZB-0e57a3ba0c
EUVD lists authentication bypass in Vvveb password reset before 1.0.8.7 (EUVD-2026-114082)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Vvveb
- Product
- Vvveb
- First seen
Summary
A Mastodon post relaying an EUVD entry says the password reset function in Vvveb versions before 1.0.8.7 is vulnerable to authentication bypass because user and token validation is insufficient. The entry gives a CVSS v3.1 score of 9.8/10.
If you use Vvveb
Update Vvveb to version 1.0.8.7 or later
Review accounts for unexpected password resets
Review the EUVD-2026-114082 entry for details
What the sources say 1
· Mastodon: “Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token G...” Source