Vulnerability · Published Sep 21, 2026 · Assigned by VulnCheck

CVE-2026-93340Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Medium 6.8

In plain English

A medium-severity security flaw in Gladys Assistant from Gladys Assistant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

Affected products (as reported)

Vendor	Product	Versions
Gladys Assistant	Gladys Assistant	0 – before 5.1.0

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Maintainer Blog release-notes
Gladys Assistant v5.1.0 Release Notes patch, release-notes
https://www.vulncheck.com/advisories/gladys-assistant-password-reset-link-poisoning-via-forgot-password-endpoint third-party-advisory