TI-2026-62932 Aliases CVE-2026-93340 GHSA-47ff-wp9w-g26c

Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

LOW 35CWE-640Published 2026-09-21 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: High
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00528 44th percentileScored 2026-11-07

Fix Fixed Gladys Assistant (Gladys Assistant): 5.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gladys Assistant	Gladys Assistant	before 5.1.0	5.1.0	Patch available	CNA

Gladys Assistant VendorGladys Assistant Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA

Remediation

Fix · CNA Gladys Assistant (Gladys Assistant) Fixed in 5.1.0

Timeline

2026-10-02 Threatist record created from CVE-2026-93340
2026-10-03 Alias added: GHSA-47ff-wp9w-g26c

References

Patch 1

Gladys Assistant v5.1.0 Release Notes

Other 1

Maintainer Blog

TI-2023-25650 Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. CVSS 3.1MEDIUM 6.5
TI-2023-23158 A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences