Authentication Bypass via Weak Password Reset Codes in Databasus

Executive Summary

CVE-2026-110770 is an authentication bypass flaw in Databasus versions 3.7.0 through 3.61.0. It allows unauthenticated attackers to brute-force six-digit password reset codes via POST /api/v1/users/reset-password. The system lacks rate limiting, lockout protections, or code invalidation, enabling attackers to guess codes and take over accounts, including administrators.

Useful 0 Not Useful 0

Detection Guidance

Check for repeated POST requests to /api/v1/users/reset-password from the same IP or user agent. Monitor logs for multiple failed password reset attempts within a short timeframe. Verify if six-digit reset codes are being brute-forced by analyzing authentication logs for successful password resets following many failed attempts.

Useful 0 Not Useful 0

Impact Analysis

Attackers can gain unauthorized access to user accounts, including admin accounts, by brute-forcing password reset codes. This may lead to data theft, unauthorized backups, system configuration changes, or privilege escalation. The impact depends on the compromised account's privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access controls. GDPR requires adequate security measures to protect personal data, while HIPAA mandates strict access controls for protected health information. Exploitation may lead to unauthorized data access, breaching these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Implement rate limiting on /api/v1/users/reset-password endpoint. Add account lockout after a few failed attempts. Invalidate reset codes after each failed attempt or set a shorter validity window. Ensure reset codes are single-use and expire immediately after use or after a short period.

Useful 0 Not Useful 0