Live › vulnerability › CVE-2026-115973
Go to dashboardFaveo Helpdesk 2.0.3 builds its own password reset instead of using Laravel's PasswordBroker. Per the researcher, reset tokens are stored in plaintext, have no expiry, and are not deleted after use, so a token leaked once (mail logs, browser history, forwarded email) stays a working account-takeover credential. The attacker needs a leaked token, not a way to guess one. Tested only by calling the controllers directly in a local install; the vendor has not published a fix or advisory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:23 UTC. All times on this page are UTC.
Installations of FaveoSuite Faveo Helpdesk 2.0.3 are affected, per the sources. The affected code is app/Http/Controllers/Auth/ForgotPasswordController.php. The sources do not say which configurations or roles are exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| faveo-helpdesk | vendor | 2.0.3 | – |
2.0.3 (check the version in the admin panel or in the release tag you deployed)? Look at app/Http/Controllers/Auth/PasswordController.php: if reset() compares the token as a plain string, never checks password_resets.created_at, and never deletes the row after use, you are exposedv2.0.3 is the latest release listedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-115973")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.