{"id":"CVE-2026-110951","kind":"vulnerability","aliases":["CVE-2026-110951"],"related":[],"title":"Hyper e-commerce platform: weak password recovery lets attackers reset accounts","description":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - dealer integration, and Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure - Storefront application and management panel allows Password Recovery Exploitation.\n\nThis issue affects Hyper E-Commerce Infrastructure: before 1.1; Hyper E-Commerce Infrastructure - dealer integration: before 1.2; Hyper E-Commerce Infrastructure - Storefront application and management panel: before 2.1796.","summary":"Hyper Teknoloji's e-commerce infrastructure, its dealer integration and its storefront and management panel use a weak forgotten-password recovery mechanism. A remote attacker can exploit it to recover or reset account passwords they should not control.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hyper E-Commerce Infrastructure","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dealer-integration","e-commerce","hyper-e-commerce","other","storefront"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Hyper E-Commerce Infrastructure version against the affected ranges in the advisory\n- Check the dealer integration version and the storefront and management panel version","fix":"- Hyper E-Commerce Infrastructure: move to `1.1` or later\n- Dealer integration: move to `1.2` or later\n- Storefront application and management panel: move to `2.1796` or later","status":"open","published_at":"2026-11-12T13:17:08+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:51+00:00","updated_at":"2026-11-12T13:38:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T13:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- Hyper E-Commerce Infrastructure: move to `1.1` or later\n- Dealer integration: move to `1.2` or later\n- Storefront application and management panel: move to `2.1796` or later","reach":"internet","title":"Hyper e-commerce platform: weak password recovery lets attackers reset accounts","impact":"high","summary":"Hyper Teknoloji's e-commerce infrastructure, its dealer integration and its storefront and management panel use a weak forgotten-password recovery mechanism. A remote attacker can exploit it to recover or reset account passwords they should not control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hyper-e-commerce","dealer-integration","storefront","e-commerce"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over customer or admin accounts via password reset","analyst_note":"Check the NVD entry and the vendor advisory for the exact recovery flaw, the attack path and whether a fix is published for all three components.","how_to_check":"- Check the installed Hyper E-Commerce Infrastructure version against the affected ranges in the advisory\n- Check the dealer integration version and the storefront and management panel version\n- unknown for any command or config file path, the sources do not say","plain_action":"","product_name":"Hyper E-Commerce Infrastructure","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Businesses running Hyper E-Commerce Infrastructure before 1.1, the dealer integration before 1.2, or the storefront and management panel before 2.1796 are exposed, because the forgotten-password flow can be abused to take over accounts. The sources do not say which deployment setups are affected beyond these version ranges, so teams on newer versions can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000813,"input_tokens":4715,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110951':15A,18A '-2026':14A,17A '1.1':133C '1.2':142C '2.1796':154C 'account':12A,70B 'affect':126C 'allow':120C 'applic':116C,149C 'attack':10A,62B 'commerc':4A,29B,33B,41B,92C,101C,113C,130C,137C,146C 'commerce':22A 'control':75B 'cve':13A,16A 'dealer':25B,44B,103C,139C 'dealer-integr':24B 'e':3A,21A,28B,32B,40B,91C,100C,112C,129C,136C,145C 'e-commerc':2A,27B,39B,90C,99C,111C,128C,135C,144C 'e-commerce':20A 'exploit':64B,123C 'forgotten':56B,81C 'forgotten-password':55B 'hyper':1A,19A,31B,36B,85C,89C,94C,98C,106C,110C,127C,134C,143C 'hyper-e-commerc':30B 'infrastructur':42B,93C,102C,114C,131C,138C,147C 'infrastructure':23A 'integr':26B,45B,104C,140C 'issu':125C 'let':9A 'ltd':87C,96C,108C 'manag':50B,118C,151C 'mechan':59B,79C 'panel':51B,119C,152C 'password':7A,57B,71B,77C,82C,121C 'platform':5A 'recov':67B 'recoveri':8A,58B,78C,122C 'remot':61B 'reset':11A,69B 'storefront':35B,48B,115C,148C 'teknoloji':37B,86C,95C,107C 'use':52B 'vulner':83C 'weak':6A,54B,76C 'şti':88C,97C,109C","nicknames":[],"mitigations":[],"who_affected":"Businesses running Hyper E-Commerce Infrastructure before 1.1, the dealer integration before 1.2, or the storefront and management panel before 2.1796 are exposed, because the forgotten-password flow can be abused to take over accounts. The sources do not say which deployment setups are affected beyond these version ranges, so teams on newer versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ecommerceinfrastructure","hyperecommerceinfrastructure"],"ptokens":["commerce","hyper","infrastructure"],"labels":["dealerintegration","ecommerce","high","hyperecommerce","other","storefront","vendor"],"campaign_type":null,"search_a":"'-110951':15A,18A '-2026':14A,17A 'account':12A 'attack':10A 'commerc':4A 'commerce':22A 'cve':13A,16A 'e':3A,21A 'e-commerc':2A 'e-commerce':20A 'hyper':1A,19A 'infrastructure':23A 'let':9A 'password':7A 'platform':5A 'recoveri':8A 'reset':11A 'weak':6A","search_b":"'account':70B 'attack':62B 'commerc':29B,33B,41B 'control':75B 'dealer':25B,44B 'dealer-integr':24B 'e':28B,32B,40B 'e-commerc':27B,39B 'exploit':64B 'forgotten':56B 'forgotten-password':55B 'hyper':31B,36B 'hyper-e-commerc':30B 'infrastructur':42B 'integr':26B,45B 'manag':50B 'mechan':59B 'panel':51B 'password':57B,71B 'recov':67B 'recoveri':58B 'remot':61B 'reset':69B 'storefront':35B,48B 'teknoloji':37B 'use':52B 'weak':54B","search_c":"'1.1':133C '1.2':142C '2.1796':154C 'affect':126C 'allow':120C 'applic':116C,149C 'commerc':92C,101C,113C,130C,137C,146C 'dealer':103C,139C 'e':91C,100C,112C,129C,136C,145C 'e-commerc':90C,99C,111C,128C,135C,144C 'exploit':123C 'forgotten':81C 'hyper':85C,89C,94C,98C,106C,110C,127C,134C,143C 'infrastructur':93C,102C,114C,131C,138C,147C 'integr':104C,140C 'issu':125C 'ltd':87C,96C,108C 'manag':118C,151C 'mechan':79C 'panel':119C,152C 'password':77C,82C,121C 'recoveri':78C,122C 'storefront':115C,148C 'teknoloji':86C,95C,107C 'vulner':83C 'weak':76C 'şti':88C,97C,109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110951","severity":null,"published_at":"2026-11-12T13:17:08+00:00","modified_at":"2026-11-12T13:17:08+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}