Loading story…
Pimcore disclosed and fixed CVE-2026-55207, an account takeover flaw in the password reset workflow that can let an unauthenticated attacker hijack any administrator account and bypass 2FA. The issue stems from insufficient validation of a user-supplied resetPasswordUrl: if an attacker knows a valid admin username, they can trigger a password reset that sends a legitimate recovery token to attacker-controlled infrastructure. If the targeted user clicks the emailed link, the attacker can capture the token and authenticate through the /pimcore-studio/api/login/token endpoint with full administrative privileges.
The vulnerability affects Pimcore versions before 2025.4.6 and versions 2026.1.0 through before 2026.1.6. Pimcore addressed the issue in 2025.4.6 and 2026.1.6; the latter release notes explicitly mention reset password URL validation among the security-relevant changes. The flaw is tracked as CVE-2026-55207, mapped to CWE-640, and carries a high-severity CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-55207 was newly recorded on 2026-07-09 for a Pimcore vulnerability that lets an unauthenticated attacker hijack an admin account by injecting an attacker-controlled resetPasswordUrl into the password reset flow. The issue can lead to full admin access and 2FA bypass, and affects versions before 2025.4.6 and 2026.1.0 through before 2026.1.6.
Pimcore released studio-backend-bundle version 2026.1.6 on 2026-06-29. The release included security-relevant reset password URL validation, which addresses the password reset URL injection issue affecting 2026.1.x versions before 2026.1.6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and the Keycloak project patched **CVE-2026-18963**, a critical flaw in the `keycloak-services` component that allows an unauthenticated remote attacker to take over arbitrary accounts, including administrators. The vulnerability affects the password recovery process: improper state validation in the reset-credentials flow lets a crafted request bypass the normal email verification or action-token step and proceed directly to changing a user's password. Red Hat assigned the issue a **CVSS 9.1** score and classified it as **CWE-640**. Affected versions include upstream Keycloak releases earlier than **26.7.2** and Red Hat Build of Keycloak versions earlier than **26.4.15** and **26.6.6**. Red Hat and CERT-PY urged organizations to apply the available security updates, while Red Hat also published a temporary mitigation for environments that cannot patch immediately by disabling the **"Forgot password"** feature across all realms. A Nuclei template pull request was also opened to detect the issue, underscoring rapid defender interest, although no verified public exploit or confirmed in-the-wild exploitation had been reported at publication time.
Aug 31, 2026
**watchTowr Labs** disclosed **WT-2026-0001**, an **authentication bypass** in *SmarterTools SmarterMail* that allows a user to reset the **system administrator password** via a password-reset mechanism and then leverage SmarterMail’s built-in “RCE-as-a-feature” capabilities to execute OS commands. The researcher reported the issue and stated it was patched quickly, citing a fixed release on **SmarterMail release 9511 (2026-01-15)**; the publication was accelerated after a tip that attackers were actively exploiting the flaw to reset admin passwords, with forum-shared logs reportedly showing suspicious activity tied to the `force-reset-password` endpoint. **Resecurity** reported exploitation of **CVE-2026-22794** in *Appsmith*, a critical authentication weakness in the password reset flow where the application trusts a **client-controlled `Origin` header** to build reset links. An attacker can initiate a reset for a victim while supplying a malicious Origin so the victim’s email contains a link to attacker infrastructure; when clicked, the reset token is exposed, enabling password change and **full account takeover**. Resecurity identified the affected endpoint as `/api/v1/users/forgotPassword`, stated **Appsmith ≤ 1.92** is affected, and that the issue is fixed in **Appsmith ≥ 1.93**.
Jun 29, 2026
SmarterTools *SmarterMail* patched a critical authentication bypass tracked as **WT-2026-0001** after researchers reported that attackers can reset the **system administrator** password without authentication by abusing the `/api/v1/auth/force-reset-password` endpoint. The flaw stems from logic in `SmarterMail.Web.Api.AuthenticationController.ForceResetPassword` that permits anonymous access and trusts a user-supplied boolean (`IsSysAdmin`); when set to `true`, the code path updates an admin account’s password without validating the old password or enforcing authorization checks. Both reporting indicate the issue is **actively exploited in the wild**, with observed exploitation occurring **within days of the vendor patch** (including reports of activity as soon as two days after release). Once an attacker resets the admin password, they can take over the mail server and leverage built-in administrative capabilities to execute OS commands, effectively achieving **remote code execution (RCE)** and full compromise of affected SmarterMail deployments; the patch was released as **Build 9511** following responsible disclosure by watchTowr Labs researchers **Piotr Bazydlo** and **Sina Kheirkhah**.
Jun 29, 2026