Cyber Posture

CVE-2026-35676

HighPublic PoC
Microsoft: not affectedMSmacOS: not affectedMacLinux: not affectedLnxMobile: not affectedMobNetwork: not affectedNetApplication: not affectedAppOther: affectedOth

Published: 28 May 2026

Published
28 May 2026
Modified
28 May 2026
KEV Added
—
Patch
—
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
EPSS Score N/A
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35676 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IA-5 Authenticator Management
addresses: CWE-640

Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.

NVD Description

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by…

more

sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-640
OWASP Top 10 Web 2025
A07:2025

EU & UK References

References