EUVD-2025-28704
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.
Analysis
Allegra project tracking software contains an authentication bypass in the password recovery token generation. Unauthenticated remote attackers can calculate the token expiration date and generate valid password reset tokens, allowing them to reset any user's password including administrators.
Technical Context
The calculateTokenExpDate function uses a predictable algorithm for generating password recovery tokens. An attacker can reverse-engineer or predict valid tokens without access to the target's email. By generating a valid reset token for the admin account, the attacker resets the password and gains full administrative access.
Affected Products
['Allegra (affected versions)']
Remediation
Apply the vendor's security patch. Implement cryptographically secure random token generation. Add email verification for password resets. Monitor admin accounts for unauthorized password changes.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today