What is the CVSS score of CVE-2026-28213?

CVE-2026-28213 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Evershop are affected by CVE-2026-28213?

A critical vulnerability in EverShop's password reset functionality could allow attackers to gain unauthorized access to customer accounts without valid credentials.

How to fix or mitigate CVE-2026-28213?

Within 24 hours: Disable the 'Forgot Password' feature if operationally feasible, or implement emergency WAF rules to restrict access to password reset endpoints. Within 7 days: Contact EverShop for patch availability timeline and security advisory details; assess customer communication requirements. Within 30 days: Apply vendor patch immediately upon release; conduct forensic analysis for unauthorized account access; notify affected customers and regulators if compromise is confirmed.

Evershop CVE-2026-28213

CRITICAL

Information Exposure (CWE-200)

2026-02-26 security-advisories@github.com

Information Disclosure Evershop

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Feb 26, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

AnalysisAI

Information disclosure in EverShop e-commerce platform before 2.1.1 through the Forgot Password functionality. API responses reveal sensitive information when invalid data is submitted.