CVE-2026-93340: Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgotpassword endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gladys Assistantto a version that resolves this vulnerability.Fixed in 5.1.0 - Configuration
Ensure the forgot_password endpoint performs server-side validation of the client-supplied origin parameter (do not trust attacker-controlled origin values).
Gladys Assistant (forgot_password endpoint) origin parameter server-side validation = validated/whitelisted (reject attacker-controlled origin)
Event History
Frequently Asked Questions
Which deployments are affected?
Gladys Assistant versions before 5.1.0 are affected. The issue is in the forgot_password endpoint.
What does an attacker need to exploit this?
An attacker does not need an account or prior privileges. Exploitation requires sending a crafted password-reset request with an attacker-controlled origin value and relies on the victim using the resulting reset link.
What is the impact if exploitation succeeds?
The attacker can obtain a valid password-reset token for a targeted account and take over that account. Administrator accounts can also be affected, enabling full administrator account takeover.
How can I determine whether an instance may be vulnerable?
Check whether the Gladys Assistant version is earlier than 5.1.0. Also review password-reset behavior and requests to the forgot_password endpoint for client-supplied origin values that are not validated server-side.