EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
Priority MEDIUM 49CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-640.
Summary
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix Fixed evershop (evershopcommerce): 2.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| evershopcommerce | evershop | before 2.1.1 | 2.1.1 | Patch available | CNA |
- evershop Vendorevershopcommerce Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
Remediation
- Fix · CNA evershop (evershopcommerce) Fixed in 2.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-28213
References
More evershopcommerce vulnerabilities
- TI-2026-51069 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover CVSS 4.0CRITICAL 9.3
- TI-2026-79260 EverShop customer API missing authorization lets attackers change addresses CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences