Zero Radar
← feed
CriticalVulnerabilityCVE-2026-43845updated 25 Oct 2026, 15:20 UTC

Password reset flaw lets attackers bypass login checks

A weakness in how passwords are reset may let an attacker get into an account without knowing its password. If you run software with this reset feature, someone could take over accounts.

Official, 2 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

The password reset mechanism contains a flaw that allows authentication to be bypassed. The affected product, versions, and exact technical cause are not stated in the available material.

Why it is dangerous: An attacker who bypasses authentication can access accounts they do not own, potentially including administrator accounts and the data they control.

Are you affected?

You are affected if you run the software that contains the vulnerable password reset mechanism; the specific products and versions are not named in the available sources.

What to do

  1. Identify whether your software includes a password reset feature from the affected product and check the GitHub advisory GHSA-rvm7-jmf3-hgwj for affected versions
  2. Apply the vendor's security update as soon as it is available, or follow any official mitigation the advisory describes
  3. Review recent password reset and login activity for unexpected account access until the fix is in place

Timeline

  1. 20 Oct 2026, 09:17 UTC
    Publicly disclosed
  2. 20 Oct 2026, 09:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-43845 · GHSA-rvm7-jmf3-hgwj
CVSS
9.2 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 09:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Password reset flaw lets attackers bypass login checks · Zero Radar