SOGo vulnerability in password reset links
SOGo uses client-supplied Origin header for password reset links, allowing remote attackers to obtain tokens and take over user accounts.
Stories per day · 30 days
1 RSS
12 stories, newest first · one card per story
Stories tagged #password-reset
DreamHost resets some email and FTP passwords after systems issue
File Manager was taken offline and later restored; DreamHost has not stated a cause or how many users were affected.
DreamHost resets some email and FTP passwords after service incident
File Manager is back, but DreamHost still has not named a cause or how many accounts needed resets.
1
DreamHost forces password resets after File Manager and webmail incident
The hoster expired affected email and FTP/SFTP passwords but has not confirmed unauthorized access or data theft.
1
DreamHost forces email and FTP password resets after unexplained incident
DreamHost has not named a cause or confirmed theft; File Manager was back by October 26 while resets stayed required.
1
Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes
Microsoft attributes to Storm-3068 an intrusion that hijacked one account via password reset, then abused Azure DevOps pipelines to steal Kubernetes credentials.
2
Beyond source code: A path to the keys to the kingdom
Microsoft DART details how Storm-3068 hijacked an account via self-service password reset, then used Azure DevOps pipelines to harvest Kubernetes credentials across 50+ resources.
1
Microsoft Password Reset Portal Could Reveal Users and MFA Protection Details
Microsoft Entra ID’s public password-reset portal can reveal valid accounts and registered MFA methods to unauthenticated users.
ZTE SmartLife Flaws Let Attackers Hijack Accounts by Resetting Passwords Without Verification
ZTE patched four SmartLife flaws, including an 8.8-severity password reset that enables account takeover.
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.
X Money rollout linked to password-reset attacks
X is investigating bulk unsolicited password-reset emails as its X Money payments service expands, with no confirmed breaches or account takeovers yet.
1
X says attackers are targeting user accounts after the launch of X Money
X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.
1