Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110770Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
High 8.1
In plain English
A high-severity security flaw in databasus from databasus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
Affected products (as reported)
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force technical-description, exploit
- https://github.com/databasus/databasus/blob/9ee25ed8f47b1b537468417e1bb52ed2d76218a0/backend/internal/features/users/services/user_services.go#L637 technical-description
- https://github.com/databasus/databasus product
- VulnCheck Advisory: Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force third-party-advisory