SS-2026-004 Password reset token account takeover
- Severity:
- Medium (?)
- Identifier:
- SS-2026-004
- Versions Affected:
- silverstripe/framework: < 6.2.13
- Versions Fixed:
- silverstripe/framework: 6.2.13
- Release Date:
- 2026-10-28
For members with no password encryption settings stored, a password reset token issued to one member could be accepted for another member. This could be used to reset the other member's password and log in as them.
Base CVSS: 6.8
Reported by: Mufeed VH from Winfunc
