EUVD-2026-84183
GHSA-47ff-wp9w-g26c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network trigger (PR:N, AV:N), but AC:H and UI:R because the attacker must target a known account and the victim must click the poisoned link; token leak yields full account (incl. admin) C:H/I:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.
AnalysisAI
Password reset link poisoning in Gladys Assistant before 5.1.0 lets unauthenticated remote attackers obtain valid password reset tokens for arbitrary accounts by sending a crafted request with an attacker-controlled origin parameter to the forgot_password endpoint. The flaw requires victim interaction-the targeted user must click the poisoned reset link delivered to their mailbox-so it is a targeted, phishing-dependent account-takeover vector rather than a hands-off exploit; successful abuse can compromise administrator accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Gladys Assistant forgot_password endpoint to be network-reachable and running a version before 5.1.0 that trusts the client-supplied origin parameter without server-side validation (the default/vulnerable state pre-patch). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but conditionally-gated account-takeover flaw, not an inflated high-CVSS issue - yet not a top-tier fire drill either. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Gladys Assistant 5.1.0 (or later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Gladys Assistant instance in the environment and identify any deployment running a version below 5.1.0, prioritizing internet-facing instances and those where administrators use the platform; notify administrators to treat unexpected or unsolicited password-reset emails with suspicion until upgrades are complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gladys Assistant
View allGladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerab
A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today