CVE-2026-93556
Received Received - Intake

Password Reset Vulnerability in Application via JWT Manipulation

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-93556
EUVD
EUVD-2026-84341

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kompini tankuam_places to 2025-11-25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the password recovery endpoint of Tankuam Places software. It allows unauthenticated attackers to manipulate the 'usuariId' parameter to reset passwords for any account, including administrative ones, by bypassing JWT token validation. This could grant attackers full control over affected accounts.

Detection Guidance

To detect this vulnerability, check if your Tankuam Places system is running a version published before 25 November 2025. Test the /password/guardarClau/recover endpoint by sending requests with manipulated 'usuariId' parameters and observe if password reset tokens are issued without proper validation.

Impact Analysis

An attacker could exploit this to reset passwords for any user account, including administrative accounts, potentially gaining full control over the system. This could lead to unauthorized access, data breaches, or complete compromise of the affected software.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches and lack of proper access controls.

Mitigation Strategies

Immediately update Tankuam Places to the latest version released after 25 November 2025. If an update is not available, disable the affected endpoint or implement strict JWT token validation tied to the 'usuariId' parameter to prevent unauthorized password resets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart