CVE-2026-101041
Received Received - Intake

TOCTOU Race Condition in Vulnerability-Lookup Password Reset

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: CIRCL

Description
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then consumed (cleared) it in separate database operations. Two concurrent HTTP requests presenting the same valid recovery token could both pass the verification check before either transaction committed, allowing both to set their own password on the target account. The last transaction to commit overwrites the first, enabling an attacker who possesses a valid recovery token to replace the legitimate user's password with one of their choosing. A secondary defect in the same endpoint (confirm_account) allowed a valid recovery link to be used to set an empty or trivially short password (e.g., three characters). The view handler performed only a manual equality comparison between the two password fields and never invoked the form's validation logic, bypassing the intended minimum-length and complexity constraints. The affected component is the user account recovery endpoint (/user/confirm_account/<token>) and the associated token verification and consumption logic in the User model (website/models/user.py) and the view layer (website/web/views/user.py).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101041
EUVD
EUVD-2026-87956

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vulnerability-lookup vulnerability-lookup *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a time-of-check-to-time-of-use (TOCTOU) race condition in the account recovery (password reset) functionality. It allows two concurrent requests using the same valid recovery token to both pass verification before either updates the database. The last request to commit overwrites the first, letting an attacker with a valid token replace the legitimate user's password. Additionally, the system allowed setting weak or empty passwords during recovery due to missing validation logic.

The affected components are the user account recovery endpoint (/user/confirm_account/<token>) and the associated token verification and consumption logic in the User model and view layer.

Detection Guidance

To detect this vulnerability, monitor the account recovery endpoint (/user/confirm_account/<token>) for concurrent requests using the same token. Check logs for multiple successful password resets with the same token. Use database queries to verify if tokens are properly invalidated after use. Example commands: grep for concurrent requests in access logs, check database for duplicate token usage, and review application logs for race condition indicators.

Impact Analysis

An attacker could exploit this to take over your account by intercepting or obtaining a valid recovery token. They could reset your password even if you initiated recovery, locking you out. The attacker could also set a weak password, making your account easier to compromise again. This could lead to unauthorized access to sensitive data associated with your account.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It undermines access controls and could result in data breaches, triggering mandatory breach notification obligations under these regulations.

Mitigation Strategies

Immediately update the User model and view layer to use atomic token consumption and password updates. Implement proper password validation in the recovery form. Replace the existing token consumption logic with the new atomic method reset_password_with_account_token. Ensure tokens are single-use and properly invalidated after use. Test the changes thoroughly to confirm race conditions are resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart