EUVD-2025-28704Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password recovery security
|
| Impact | CVSS 9.8, EPSS 25.4%, PoC available. Allegra is a commercial project management and issue tracking platform. Admin access provides control over all projects, tasks, and user data. |
| Exploit ScenarioDerived | An attacker exploits the predictable token generation to create a valid password reset token for the admin user. They reset the admin password and log in. They access all project data, export issue databases, and modify user permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Allegra project tracking software contains an authentication bypass in the password recovery token generation. Unauthenticated remote attackers can calculate the token expiration date and generate valid password reset tokens, allowing them to reset any user's password including administrators.
Earlier versions of this analysis (1)
Authentication bypass in Allegra via predictable password recovery tokens enables unauthenticated admin account takeover.
RemediationAI
Apply the vendor's security patch. Implement cryptographically secure random token generation. Add email verification for password resets. Monitor admin accounts for unauthorized password changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The calculateTokenExpDate function uses a predictable algorithm for generating password recovery tokens. An attacker can reverse-engineer or predict valid tokens without access to the target's email. By generating a valid reset token for the admin account, the attacker resets the password and gains full administrative access.
Know when Allegra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.
Executive ViewAI
A critical authentication bypass vulnerability in Allegra's password recovery mechanism allows unauthenticated attackers to gain unauthorized access to user accounts. This poses an immediate risk to any organization using Allegra, as attackers can reset passwords and compromise sensitive data without detection. With no patch currently available, immediate mitigation is required to protect against active exploitation.
Disable password recovery feature if business-critical; restrict password reset endpoint to whitelisted IP ranges; implement WAF rules to rate-limit and block password recovery requests; enable multi-factor authentication (MFA) on all accounts to prevent account takeover despite compromised passwords; increase logging and alerting on authentication failures and password changes; consider network segmentation to limit Allegra access to trusted users only; monitor for unauthorized account access patterns and credential usage anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Directory traversal vulnerability in Allegra's extractFileFromZip method that allows authenticated attackers to execute
Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerab
Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. Rated high severity (CVSS
Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. Rated high severity (CVS
Directory traversal in Allegra's exportReport method exposes arbitrary server-side files to authenticated remote attacke
Allegra getLinkText Server-Side Template Injection Remote Code Execution Vulnerability. Rated medium severity (CVSS 6.3)
Cross-site scripting in Allegra's downloadAttachment method enables authenticated remote attackers to inject and execute
Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this v
Exploit-DB