CVE-2026-93340 in Gladys Assistant
Summary
by MITRE • 09/22/2026
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Gladys Assistant versions prior to 5.1.0 represents a critical security flaw rooted in improper validation of user-supplied input within the password recovery mechanism. Specifically, the application fails to perform server-side validation on the origin parameter provided by clients during requests to the forgot_password endpoint. This oversight allows unauthenticated remote attackers to manipulate the context in which password reset links are generated and delivered. By injecting a maliciously crafted domain or URL into this parameter, an attacker can influence the structure of the resulting password reset link sent to the victim user. The core technical failure lies in the application's trust of client-side data without verifying that it matches expected, legitimate domains configured for the service. This lack of validation creates a pathway for attackers to control the destination or context associated with sensitive authentication tokens, fundamentally undermining the integrity of the account recovery process.
From an operational perspective, this vulnerability enables full account takeover through social engineering and technical exploitation combined. When an attacker successfully poisons the password reset link by specifying their own controlled origin in the request, the resulting email sent to the victim contains a link that appears legitimate but is actually directed towards infrastructure controlled by the attacker or configured to leak sensitive data. Upon clicking this poisoned link, the victim's browser may disclose session tokens or other authentication credentials back to the attacker due to misconfigured redirect behaviors or cross-origin resource sharing issues inherent in the flawed implementation. This disclosure allows the attacker to hijack the active session of any user account targeted by the attack vector. The severity is amplified because the vulnerability affects all accounts, including those with administrative privileges, thereby granting attackers complete control over the system and its data without requiring prior authentication or valid credentials for the target account.
This type of flaw aligns closely with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), although in this specific context, it manifests as a more severe password reset link poisoning scenario often categorized under CWE-284 Improper Access Control or related to CWE-359 Exposure of Private Information. The attack technique is consistent with MITRE ATT&CK tactics involving Initial Access and Credential Access, specifically leveraging phishing techniques where the attacker crafts deceptive communications that appear authentic but lead to credential theft. The exploitation does not require complex bypasses of authentication mechanisms; instead, it relies on the victim's trust in the email communication channel and the application's failure to sanitize input data before using it in security-critical operations like generating reset tokens.
To mitigate this vulnerability, immediate action is required to enforce strict server-side validation of all origin parameters used in password recovery workflows. Developers should implement a whitelist approach where only pre-approved, trusted domains are accepted for constructing redirect URLs or embedding within email templates. Additionally, implementing SameSite cookie attributes and ensuring that session cookies are not transmitted via URL parameters can reduce the risk of token leakage during redirections. It is also advisable to use short-lived password reset tokens with single-use constraints to limit the window of opportunity for exploitation even if a link is intercepted. Upgrading to version 5.1.0 or later, where these input validation checks have been properly implemented, is the primary remediation step recommended by the vendor. Until such updates are applied, organizations should monitor logs for unusual patterns in password reset requests and consider disabling public-facing access to affected endpoints if feasible.