CVE-2026-102603
Received Received - Intake

Gotify Server Password Change Authentication Bypass

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-102603
EUVD
EUVD-2026-98753

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gotify server < 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Gotify server before version 3.0.0 has a flaw in the password change endpoint. It allows changing a user's password using only a valid client token, without requiring the current password or additional authentication. This lets an attacker with a token to take over the account and force password recovery.

Detection Guidance

Check if your Gotify server version is below 3.0.0 by running: gotify version. If the version is older, the vulnerability is likely present. Inspect network traffic for POST requests to /current/user/password without requiring the current password.

Impact Analysis

If an attacker obtains your client token, they can change your password and gain full control of your account. This could lead to unauthorized access to your messages and data. You would need to recover the account through an administrator or direct database access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Gotify versions may face compliance failures due to insufficient authentication controls.

Mitigation Strategies

Upgrade to Gotify server version 3.0.0 or later immediately. If upgrading is not possible, restrict access to the password change endpoint via network controls or disable the endpoint until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart