A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and e…

Published:

11 januari 2026 om 23:00:00

Alert date:

12 januari 2026 om 21:02:40

Source:

nvd.nist.gov

Web Technologies, Identity & Access

A critical vulnerability in DDSN Interactive Acora CMS v10.7.1 allows attackers to perform full account takeover through a static password reset token flaw. The vulnerability enables arbitrary password resets via replay attacks due to the use of static tokens in the password reset function. This security flaw permits complete compromise of user accounts without requiring initial authentication or user interaction.

Technical details

Mitigation steps:

Affected products:

DDSN Interactive Acora CMS