PT-2026-24256 · Telekom · Account Management Portal

Published 2026-03-10 · Updated 2026-05-07 · CVE-2025-69614

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Deutsche Telekom AG Telekom Account Management Portal versions prior to 2025-10-27

Description An incorrect access control issue exists due to activation token reuse on the password-reset endpoint. This allows unauthorized password resets and potential full account takeover. The issue was fixed on 2025-10-31. The affected API endpoint is the password-reset endpoint.

Recommendations Update to versions 2025-10-27 or later.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-69614

Affected Products

Account Management Portal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-69614 · Security Note
• https://telekom.com/en/company/data-privacy-and-security/news/acknowledgements-358300#R · Note
• https://t.me/cveNotify/162631 · Telegram Post
• https://twitter.com/CVEnew/status/2034520458213695587 · Twitter Post
• https://gist.github.com/ethicalrohitt/b3e6d071aac8530459e8b3a5720bb832 · Note
• https://twitter.com/infoflowcloud/status/2034521895064805390 · Twitter Post