CVE-2026-93340

MEDIUM 6.8

Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

CWE	CWE-640
Vendor	gladys assistant
Product	gladys assistant
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for gladys assistant gladys assistant

Be the first to know when new medium vulnerabilities affecting gladys assistant gladys assistant are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Gladys Assistant / Gladys Assistant

0 < 5.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gladysassistant.com: https://gladysassistant.com/blog/gladys-5-1-integration-widgets-and-scenes/ github.com: https://github.com/GladysAssistant/Gladys/releases/tag/v5.1.0 vulncheck.com: https://www.vulncheck.com/advisories/gladys-assistant-password-reset-link-poisoning-via-forgot-password-endpoint

Credits

Pulatjonov Jasurbek VulnCheck