PT-2026-33787 · Openaev · Openaev

Published 2026-04-20 · Updated 2026-04-30 · CVE-2026-24467

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenAEV versions 1.0.0 through 2.0.12

Description The password reset implementation contains security weaknesses that allow for reliable account takeover. Password reset tokens do not expire and remain valid indefinitely, even after new tokens are issued. Additionally, these tokens are only 8 digits long. An unauthenticated remote attacker can mass-generate valid tokens and use brute-force methods to guess a valid token, enabling them to reset any registered user's password without knowing the original password or requiring a configured email service. This can lead to full platform compromise, allowing access to sensitive data and the ability to modify payloads executed by deployed agents to compromise hosts.

Recommendations Upgrade to version 2.0.13.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-24467

Affected Products

Openaev

References · 12

• https://github.com/OpenAEV-Platform/openaev/security/advisories/GHSA-vcjx-vw28-25p2 · Vendor Advisory
• https://github.com/OpenAEV-Platform/openaev/commit/c09a4e71ea76d26fc28c9b51c76bca89a902df4f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24467 · Security Note
• https://github.com/OpenAEV-Platform/openaev/releases/tag/2.0.13 · Note
• https://github.com/OpenAEV-Platform/openaev/blob/82fa7d0009017110c9b509d0dc1b3a78164259dd/openaev-api/src/main/java/io/openaev/rest/user/UserApi.java#L120 · Note
• https://twitter.com/cybrsecpath/status/2048973318817304998 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046573126197117284 · Twitter Post
• https://twitter.com/CVEnew/status/2046571937980379247 · Twitter Post
• https://twitter.com/cybrsecpath/status/2048775344715608450 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046300439436488851 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2049906328966176823 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046263845220454726 · Twitter Post