opf openproject up to 16.6.1 /account/change_password excessive authentication

Summaryinfo

A vulnerability was found in opf openproject up to 16.6.1. It has been classified as problematic. This vulnerability affects unknown code of the file /account/change_password. This manipulation causes excessive authentication. This vulnerability is tracked as CVE-2026-22603. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in opf openproject up to 16.6.1. It has been declared as critical. Affected by this vulnerability is an unknown code block of the file /account/change_password. The manipulation with an unknown input leads to a excessive authentication vulnerability. The CWE definition for the vulnerability is CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user’s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-22603 since 01/07/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 16.6.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 2b394b9ba5af1e5d96a64d7d452d4d44598a4c7f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1884). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• opf

Name

• openproject

Version

• 16.6.0
• 16.6.1

License

• open-source

Website

• Product: https://github.com/opf/openproject/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion