CWE-640

353 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 111High 139Medium 95Low 7Not scored 1

CVEs per yearBy the year they were published

CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab
GitLab · GitLab
ExploitedCritical10.0

CVE-2026-123196
Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadata
authorizerdev · authorizer
High8.6
CVE-2026-114421
Empty initial password permits GINA account takeover
SEPPmail AG · SEPPmail Secure Email Gateway (SEG)
High8.3
CVE-2026-119127
ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
zitadel · zitadel
High8.6
CVE-2026-116214
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
maccmspro · maccms10
Critical9.3
CVE-2026-94380
Host Header Injection in HAVELSAN's Liman MYS
HAVELSAN Inc. · Liman MYS
High8.1
CVE-2026-115973
FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
FaveoSuite · Faveo Helpdesk
Medium6.9
CVE-2026-58202
OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
open-reception · appointment-booking-software
High8.3
CVE-2026-46347
Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
intranda · goobi-viewer-core
Medium6.8
CVE-2026-46346
Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
intranda · goobi-viewer-core
Medium6.5
CVE-2026-86055
Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover
Part-DB · Part-DB-server
High8.7