Live › vulnerability › CVE-2026-108048
The /Account/resetPwd endpoint in Alosuite does not limit how many password reset requests can be sent for one account. A remote attacker can repeatedly trigger reset emails to a user, flooding their inbox and consuming email and application resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 13:20 UTC. All times on this page are UTC.
Teams running Alosuite whose password recovery page is reachable from the internet or an untrusted network. Deployments without the password recovery feature exposed, or with rate limiting in front of it, are less exposed. The sources do not name affected versions.
No product ranges from the sources yet.
/Account/resetPwd endpointNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.
This page as .md · .json · in your agent: get_signal("CVE-2026-108048")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.