CVE-2026-108048
Received Received - Intake

Password Reset Email Flood in AloSuite

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-108048
EUVD
EUVD-2026-115797

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AM System ALO Suite 25_09_15.03_35

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is due to a lack of request limits in Alosuite’s password recovery functionality. The '/Account/resetPwd' endpoint allows unlimited password reset requests for a single account, enabling attackers to flood a user's email with reset messages. This can disrupt legitimate users and consume system resources.

Detection Guidance

Monitor the '/Account/resetPwd' endpoint for unusually high request volumes to a single account. Check email server logs for excessive password reset emails sent to one address. Use network traffic analysis tools to detect repeated automated calls to this endpoint.

Impact Analysis

You may experience email flooding if an attacker targets your account. This can disrupt your access to legitimate emails, waste your time, and potentially lead to account lockouts or security concerns if you interact with malicious reset links.

Compliance Impact

This vulnerability could potentially impact compliance with data protection regulations such as GDPR and HIPAA by enabling abuse of the password recovery mechanism. Unlimited password reset requests may lead to unauthorized access attempts or denial-of-service conditions, compromising user data integrity and availability. Excessive automated requests could also strain email infrastructure, potentially disrupting legitimate communications required for regulatory compliance.

Mitigation Strategies

Implement rate limiting on the '/Account/resetPwd' endpoint to restrict the number of requests per account within a time window. Add CAPTCHA or other bot detection mechanisms to prevent automated abuse. Review and enforce strict email sending limits for password reset functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...