CVE-2026-90522
Received Received - Intake

Weak Password Recovery in jaychouchannel Tourism-Management-System

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90522
EUVD
EUVD-2026-77020

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jaychouchannel tourism_management_system to d984d172dceca907f8b447efbdb06dc233f7938d (inc)
jaychouchannel tourism-management-system to d984d172dceca907f8b447efbdb06dc233f7938d (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Tourism-Management-System where the password recovery function (resetPass in UsersController.java) allows weak password recovery. Attackers can remotely reset any user's password to a default value like '123456' without verifying ownership of the account. The flaw exists because the system does not require old password verification or additional authentication during password resets.

Detection Guidance

Check for unauthorized password reset requests in web server logs targeting the resetPass endpoint in UsersController.java, YonghuController.java, or DaoyouController.java. Look for requests without proper authentication or with default password values like '123456'.

Impact Analysis

This vulnerability allows attackers to take over any user account, including administrative accounts, by resetting passwords to a known value. Once compromised, attackers gain access to sensitive data, system functions, and potentially full control of the application. This can lead to data breaches, unauthorized modifications, and loss of confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. A successful exploit could result in unauthorized data exposure, leading to legal penalties, fines, and reputational damage for organizations using this system.

Mitigation Strategies

Apply the patch from commit 9cb6215ac871f99a90cde763cf003e95ff282283 to enforce old password verification and minimum password length. Ensure all resetPass methods require oldPassword and newPassword with validation. Monitor for suspicious reset attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart