CVE-2026-93556 in Tankuam Places
Summary
by MITRE • 09/22/2026
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified within the /password/guardarClau/recover endpoint represents a critical failure in identity verification logic, specifically categorized under CWE-287: Improper Authentication. The core technical flaw lies in the application's handling of the usuariId parameter during password recovery operations. While the system accepts this identifier to determine which account requires a password reset, it fails to validate that the JSON Web Token (JWT) associated with the current session or request context actually belongs to the user specified by that parameter. This decoupling of authentication state from authorization intent creates a direct path for identity manipulation, allowing an attacker to bypass standard access controls and assume the identity of arbitrary users within the system.
From an operational perspective, this flaw enables unauthenticated attackers to perform account takeover attacks with significant ease. By simply modifying the usuariId value in their request payload while retaining or forging a valid JWT token that corresponds to any other user session, the attacker can force a password reset for target accounts. This capability is particularly dangerous when applied to administrative or privileged accounts, as it grants the attacker full control over sensitive system functions and data. The lack of cross-validation between the token's subject claim and the requested resource identifier means that the application trusts client-supplied input without verifying its legitimacy against the authenticated context, a classic example of insecure direct object references leading to privilege escalation.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, most notably T1078: Valid Accounts, as it allows an attacker to gain access using legitimate credentials or by hijacking existing sessions through manipulation. It also relates to T1528: Steal Application Access Token if the JWT is obtained via other means such as session fixation or token leakage, although in this specific case, the primary issue is the lack of binding between the token and the target user ID. The absence of server-side validation ensures that even a low-privilege or unauthenticated actor can escalate their privileges by resetting passwords for high-value targets, effectively bypassing multi-factor authentication if it relies on email-based recovery codes sent to compromised accounts.
To mitigate this vulnerability, developers must implement strict binding between the JWT token and the requested resource identifier. The server should extract the user identity from the validated claims of the JWT and ensure that any subsequent parameter specifying a target account matches this extracted identity exactly. If the application design requires users to reset passwords for other accounts, such as in an administrative context, explicit authorization checks must be performed to verify that the authenticated user has the necessary permissions to perform actions on behalf of others. Additionally, implementing rate limiting and monitoring for unusual patterns of password recovery requests can help detect and prevent automated exploitation attempts. Ensuring that JWTs are issued with appropriate expiration times and using secure, HttpOnly cookies or strict header-based transmission methods further reduces the risk associated with token manipulation.