Read the docs
TI-2025-16092 Aliases CVE-2025-22144

Account Takeover in NamelessMC

Priority HIGH 78CWE-610Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00778 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NamelessMCNamelessup to 2.1.2—No fix listedCNA
  • Nameless VendorNamelessMC Affected up to 2.1.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*before 2.1.3VulnerableNamelessMC
  • cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* Versions before 2.1.3 Vulnerable ·NamelessMC

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22144

References

Exploit 1

Other 1

  • TI-2025-33960 NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor CVSS 3.1CRITICAL 9.1
  • TI-2025-23467 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages CVSS 4.0HIGH 8.6
  • TI-2025-21195 NamelessMC Has Lack of Length Validation for s Parameter in GET Requests CVSS 3.1HIGH 7.5
  • TI-2022-02614 Session Fixation in namelessmc/nameless CVSS 3.1HIGH 8.2
  • TI-2025-16090 Cross-site Scripting in NamelessMC CVSS 4.0MEDIUM 6.3
  • TI-2025-34226 NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component CVSS 3.1HIGH 7.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences