Three Critical Password Reset Flaws Expose 22,000 Exchange Servers
Three Critical Password Reset Flaws Expose 22,000 Exchange Servers
Three critical vulnerabilities disclosed this week share a common weakness: password reset logic that fails to validate tokens properly. CVE-2026-18550 in the Nokri Job Board WordPress theme allows unauthenticated attackers to hijack admin accounts through an empty token bypass. CVE-2026-84699 in Team Password Manager permits unauthorised password resets without authentication, exposing concentrated credential stores. CVE-2026-84480 in WWBN AVideo allows permanently valid reset tokens with no expiry. Meanwhile, Shadowserver…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.