CVE-2026-53904

Katalog CVE

CVSS 7.1 · High EPSS 0,34%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada mycomplianceoffice mco. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset process and continuously invalidate credentials, effectively locking the victim out of their account. Answering security questions has a limited number of tries which lowers the risk of this vulnerability. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

6 Juli 2026

Status NVD

Undergoing Analysis

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.pl/en/posts/2026/07/CVE-2026-53902 advisory pihak ketiga
• https://mco.mycomplianceoffice.com/ product