CVE-2026-73431

CVE-2026-73431 is a replay attack vulnerability in the password reset token mechanism. The application issued stateless signed tokens containing only the user's login, validated signature and age, but never tracked whether a token had been used. An attacker with a valid token could replay it across multiple password reset operations—each request succeeded independently, setting a new password each time. The vulnerability earned an 8.8 because it enables full account takeover without any existing credential knowledge. The patch introduces server-side nonce storage, making tokens single-use. Critically, it also enforces token exclusivity per user—one new reset token invalidates all previous ones. This second change is where defenders must pay attention. The one-token-per-user rule means an attacker can repeatedly request reset tokens for a target, each one invalidating the prior, effectively immunizing the account against legitimate recovery. There's no 'account locked' artifact; the target simply never receives a usable recovery email. This is a targeted denial-of-service against the recovery mechanism itself, not traditional account lockout. Detection is difficult because the vulnerability produces silent failures. Every replayed token operation looks like a valid password reset—the system has no record that the same token was used multiple times. Post-exploitation forensics will find a series of completed password changes, each legitimate from the system's perspective. Prioritise: First, verify the patch is deployed. Second, audit for any accounts that underwent multiple password resets in a short window—the attack leaves this pattern. Third, communicate to users that the one-token-per-user rule means a single malicious reset request can consume their recovery window; they should treat reset emails as time-sensitive. Fourth, recognise that the federated blast radius extends beyond this account: password reset tokens typically also gate email changes, API key regeneration, and OIDC provider unlinking. A successful exploit compromises every trust relationship the account has established. The EPSS score of 0.00279 suggests low immediate exploitation probability, but this understates risk in deployments where realistic token-acquisition paths exist—email compromise, log access, or man-in-the-middle on activation emails. In those environments, the CVSS 8.8 is actionable.

Reviewed through automated stages and approved by a human before publication.