CVE-2026-14850: Weak password recovery mechanism for forgotten password in MobiAPParc
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to interact with the password reset functionality and manipulate the predictable numeric user_id parameter. The described flaw does not require the attacker to prove ownership of the targeted account.
Who is exposed to unauthorized password resets?
Users whose accounts can be targeted through the affected password reset functionality are exposed. Because user_id values are predictable numeric identifiers, an attacker may be able to target arbitrary user accounts by changing that parameter.
How can an organization tell whether it may be affected?
Review the MobiAPParc password reset flow to determine whether it accepts a user_id parameter and whether changing that value allows a reset for another account without validating account ownership.