Vulnerability-Lookup CVE-2026-73431

Exploitation requires the attacker to possess a currently valid, unexpired account activation or password-recovery token URL for the target account - specifically a link generated by Vulnerability-Lookup's activation or recovery workflow and still within the configured TOKEN_VALIDITY_PERIOD. The token must have been generated, meaning the victim or the attacker must have already triggered an activation or recovery request for the target account. No knowledge of the victim's existing password is required, and no authenticated session on the platform is needed. Limiting factors: the attacker must obtain the token URL through an out-of-band channel such as email interception or phishing; the token expires once TOKEN_VALIDITY_PERIOD elapses; and only accounts that have an outstanding activation or recovery request are directly exposed at any given moment.

The provided CVSS 4.0 score of 8.8 (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) reflects network-exploitable account takeover with high impact on both the vulnerable system and subsequent systems - the latter plausible given Vulnerability-Lookup's role as a threat intelligence platform where account compromise could expose or manipulate sensitive CVE data downstream. AC:H correctly signals that exploitation is not trivially automated: the attacker must first capture a valid token in transit, requiring email interception, phishing, or similar means. PR:L in the provided vector likely reflects that the token itself functions as a constrained credential, though the attacker need not hold an active authenticated session on the platform. No EPSS score was provided; exploitation probability is therefore not quantifiable from available data. No CISA KEV listing exists and no public POC exploit is identified, placing real-world risk in the targeted rather than widespread category. The most credible threat actor is one with access to the victim's email channel, making this a meaningful risk for high-value accounts but not a mass-exploitation scenario.

An attacker targets a Vulnerability-Lookup user who recently requested a password reset and intercepts the recovery email - via a compromised mail server, a shared inbox, or by tricking the user into forwarding the link. The attacker submits the token URL to set a new password and gain full account access, then replays the same link repeatedly during the TOKEN_VALIDITY_PERIOD to regain control even after the legitimate user attempts to recover their account using the same link. No public exploit code is identified at time of analysis.