Password reset codes in AKIN MyRezzta can be brute forced
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.
Summary
AKIN Software MyRezzta from 2.06.03 before 2.07.01 uses a weak password recovery mechanism (CWE-640). An unauthenticated remote attacker can guess the password reset code and take over user accounts.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AKIN Software Computer Import Export Industry and Trade Ltd. | MyRezzta | 2.06.03 to before 2.07.01 | 2.07.01 | Patch available | CNA |
- MyRezzta VendorAKIN Software Computer Import Export Industry and Trade Ltd. Affected 2.06.03 to before 2.07.01 Fixed in 2.07.01 Patch available CNA
Remediation
Update MyRezzta to version 2.07.01, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA MyRezzta (AKIN Software Computer Import-Export Industry and Trade Co. Ltd.) Fixed in 2.07.01
Timeline
- 2026-10-08 Threatist record created from CVE-2026-19218
- 2026-10-08 Alias added: GHSA-m33r-p2j3-r4pf
References
More AKIN Software Computer Import Export Industry and Trade Ltd. vulnerabilities
- TI-2026-69468 Database credentials exposed in AKINSOFT WOLVOX Control Panel CVSS 3.1CRITICAL 9.8
- TI-2026-69422 AKIN OctoCloud authorization bypass exposes restricted functions CVSS 3.1HIGH 8.8
- TI-2026-09209 RCE in Akınsoft's CafePlus CVSS 3.1HIGH 8.8
- TI-2026-13115 Path Traversal in AKIN Software's Wolvox9 ERP CVSS 3.1HIGH 7.5
- TI-2025-09087 IDOR in Akınsoft QRMenu CVSS 3.1HIGH 7.5
- TI-2026-09321 Reflected XSS in Akinsoft's e-Commerce CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-19218 · CVE Program
- CVE-2026-19218 · NVD
- FIRST EPSS
- GHSA-m33r-p2j3-r4pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences