PT-2026-22209 · Evershop · Evershop

Odgrso · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28213

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.1.1

Description EverShop, a TypeScript-first eCommerce platform, has an issue in the "Forgot Password" functionality. When a target email address is provided, the API response includes the password reset token. This allows an attacker to take over the associated account. The password reset token is intended to be a secret string used to verify the user's identity.

Recommendations Update to version 2.1.1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-640

CWE-200

Related Identifiers

CVE-2026-28213

GHSA-CG73-G723-39JW

Affected Products

Evershop

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28213.json · Exploit
• https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28213 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28213 · Vendor Advisory
• https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1 · Note
• https://twitter.com/CveTodo/status/2027164021376307620 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027203374110662829 · Twitter Post
• https://twitter.com/CVEnew/status/2027466640477344199 · Twitter Post
• https://twitter.com/cracbot/status/2028787696991342938 · Twitter Post
• https://twitter.com/CveFindCom/status/2027167133700857882 · Twitter Post
• https://twitter.com/pulsepatchio/status/2027752705389670571 · Twitter Post