{"id":"CVE-2026-107640","published":"2026-10-08T15:17:47.343","lastModified":"2026-10-08T21:35:53.890","description":"Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-640"],"vendors":[],"products":[],"references":[{"url":"https://www.enablesecurity.com/advisories/ES2026-06-enswitch-password-reset-bypass/","tags":[]},{"url":"https://www.integrics.com/enswitch/","tags":[]},{"url":"https://www.vulncheck.com/advisories/integrics-enswitch-3.13-through-4.4-authentication-bypass-via-password-reset-api","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to change account passwords by omitting the reset parameter, potentially taking over administrator accounts.","exploitability":"Exploitation is relatively easy as it requires only knowledge of valid usernames and the ability to send a crafted request.","blast_radius":"If exploited, this could lead to unauthorized access to administrator accounts, compromising the entire system.","remediation":"Upgrade to Integrics Enswitch 4.5 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:27.531Z"}}