CVE-2026-60046: DoS via password reset
Published Nov 10, 2026
·Updated
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
Event History
Nov 10, 2026
CVE Published
via MITRE·08:38 AM
Data Sourced
via MITRE·08:38 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What information does an attacker need to target an account?
The attacker needs to know the target user's username and email address. No authentication or user interaction is required.
2
Is exploitation limited by password-reset rate limiting?
No. The issue is described as lacking rate limiting for password resets, allowing repeated reset attempts against accounts with known usernames and email addresses.
3
What is the operational impact of a successful attack?
An attacker can reset passwords for targeted users, preventing them from using their existing credentials. The reported impact is a total loss of availability.