CVE-2020-26061

PoC —

CVSS 3.1

7.5 high

EPSS

4%p91

Published

Oct 5, 2020 (Oct 5, 2020)

Modified

Jun 17, 2026

Description

ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user.

Vendors: clickstudios
Products: passwordstate
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (4.5%)

In the news0 stories

No ingested article mentions this CVE yet.