CVE-2026-110951: Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.
This issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are Hyper E-Commerce Infrastructure before 1.1, dealer integration before 1.2, and the Storefront application and management panel before 2.1796.
What level of access does an attacker need?
The published vector indicates that an attacker needs network access and low privileges. No user interaction is required, but exploitation is rated high complexity.
What is the potential impact if exploitation succeeds?
Successful exploitation can enable password recovery abuse leading to account takeover. The reported impact includes high confidentiality, integrity, and availability impact.