Vulnerability-Lookup up to 5.5.1 Account Activation authentication replay

Summaryinfo

A vulnerability categorized as critical has been discovered in Vulnerability-Lookup up to 5.5.1. This vulnerability affects unknown code of the component Account Activation. The manipulation results in authentication replay. This vulnerability is known as CVE-2026-73431. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Vulnerability-Lookup up to 5.5.1. It has been classified as critical. Affected is an unknown functionality of the component Account Activation. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did not track whether a token had already been successfully used. As a result, a captured activation or password-recovery link remained valid for the entire configured TOKEN_VALIDITY_PERIOD, even after the associated password had been changed. An attacker who obtains a valid activation or recovery token could therefore replay it multiple times during its validity period to set a new password and repeatedly take control of the affected account. In addition, tokens were not bound to a specific purpose, allowing the same token mechanism to be used across activation and recovery workflows. The patch introduces purpose-bound tokens and a random nonce whose SHA-256 digest is stored with the user account. The nonce is invalidated after a successful password change, making tokens single-use, while issuing a new token invalidates any previously issued token. The password-setting operation now explicitly consumes the token before committing the account change. Successful exploitation requires the attacker to obtain a currently valid activation or recovery link, but does not require knowledge of the victim's existing password or an authenticated session.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-73431 since 08/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1040.

Applying the patch bef837242657acf680832be56b94428df130ed67 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Vulnerability-Lookup

Version

• 5.5.0
• 5.5.1

Website

• Product: https://github.com/vulnerability-lookup/vulnerability-lookup/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion