CVE-2026-47181
Vulnerability Description
PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker only needs a registered account and a valid password reset token for their own account. This issue has been patched in version 1.0.0.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-20
Source
NVD
Vendor
PenguinMod
Product
PenguinMod-BackendApi
Discussion (0)
Add Comment
No comments yet. Be the first!