CVE-2026-110770: Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can attempt exploitation. They need to know the email address of a target account, and administrator accounts are included among the accounts that may be taken over.
What conditions make password reset requests vulnerable?
The reset endpoint accepts a six-digit code, and the described weakness is the absence of rate limiting, lockout, and code invalidation. An attacker can request a code for a known email address and repeatedly guess codes through POST /api/v1/users/reset-password.
Are all Databasus deployments affected by the reported issue?
The affected versions are Databasus 3.7.0 through 3.61.0. The provided information does not identify any configuration prerequisite, authentication requirement, or optional feature that would prevent exposure within that version range.