CVE-2026-107640: Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
Affected Software
Event History
Frequently Asked Questions
Which accounts can be taken over through this issue?
Accounts that have no pending password reset are affected because their empty reset_key can match the omitted reset parameter. An attacker can use this condition to change the password of an administrator account after identifying a valid username.
Does exploitation require authentication or user interaction?
No. The vulnerability is reachable through the password update API endpoint and can be exploited by an unauthenticated attacker without user interaction.
Which Enswitch versions are affected?
Integrics Enswitch versions 3.13 through 4.4 are identified as affected.