MEDIUM 6.3 NVD
CVE-2026-104468
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expir
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7
- https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-non-expiring-password-reset-toke
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-02 via NVD.
vulnfeed aggregates 10476 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.