CVE-2026-108337: Password Reset Code Accessible in User Listing API
An administrator could retrieve the password reset code for any user and take over the account.
The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Remote Ops Agentto a version that resolves this vulnerability.Fixed in 2.1 - Configuration
Disable the password reset feature in the web interface.
Remote Ops Agent password reset feature = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an attacker to already have administrative access to the application. The affected API is limited to administrator accounts.
What could an attacker do with the exposed reset codes?
An administrator could retrieve a reset code for any user and use it to reset that user's password, potentially taking over application accounts. Device credentials and customer data cannot be accessed through this vulnerability.