CVSS 8.7 (high) · published 2026-11-10
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
Weakness: CWE-640
Source: NVD CVE-2026-60046
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.