CVE-2026-28213
Received Received - Intake
Information Disclosure in EverShop Forgot Password Allows Account Takeover

Publication date: 2026-02-26

Last updated on: 2026-02-28

Assigner: GitHub, Inc.

Description
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-26
Last Modified
2026-02-28
Generated
2026-06-16
AI Q&A
2026-02-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-28213
EUVD
EUVD-2026-8911
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
evershop evershop to 2.1.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in EverShop, a TypeScript-first eCommerce platform, in versions prior to 2.1.1. It affects the "Forgot Password" functionality where, when a target email address is specified, the API response returns the password reset token directly. This behavior allows an attacker to obtain the reset token and take over the associated user account.

Impact Analysis

This vulnerability can have severe impacts as it allows an attacker to take over user accounts without any privileges or user interaction. The attacker can reset passwords and gain full control over the compromised accounts, potentially leading to unauthorized access to personal data, financial information, and other sensitive resources.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade EverShop to version 2.1.1 or later, as this version fixes the issue with the password reset token being exposed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart