CVE-2026-73431
Received Received - Intake

Authentication Token Reuse in Vulnerability-Lookup

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did not track whether a token had already been successfully used. As a result, a captured activation or password-recovery link remained valid for the entire configured TOKEN_VALIDITY_PERIOD, even after the associated password had been changed. An attacker who obtains a valid activation or recovery token could therefore replay it multiple times during its validity period to set a new password and repeatedly take control of the affected account. In addition, tokens were not bound to a specific purpose, allowing the same token mechanism to be used across activation and recovery workflows. The patch introduces purpose-bound tokens and a random nonce whose SHA-256 digest is stored with the user account. The nonce is invalidated after a successful password change, making tokens single-use, while issuing a new token invalidates any previously issued token. The password-setting operation now explicitly consumes the token before committing the account change. Successful exploitation requires the attacker to obtain a currently valid activation or recovery link, but does not require knowledge of the victim's existing password or an authenticated session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73431
EUVD
EUVD-2026-57226

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication weakness in the account activation and password-recovery system. It involves stateless signed tokens that lack tracking for successful use. Attackers can replay captured tokens multiple times within their validity period to reset passwords and take control of accounts. Tokens were not bound to specific purposes, allowing reuse across different workflows.

Impact Analysis

If you are a user of the affected system, an attacker could gain control of your account by replaying a captured activation or password-recovery link. This could lead to unauthorized access to your data, potential misuse of your account, and repeated compromise even after changing your password.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Repeated account compromise may result in data breaches, triggering mandatory breach notifications and potential fines for non-compliance with these regulations.

Mitigation Strategies

Apply the patch that introduces purpose-bound tokens and a random nonce stored with the user account. Ensure tokens are single-use and invalidated after password changes. Verify the password-setting operation consumes the token before committing account changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart