Authentication Bypass in Databasus via Reset Password Brute-Forcing

Databasus versions 3.7.0 through 3.61.0 are affected by an authentication bypass vulnerability (CVE-2026-110770) that allows unauthenticated attackers to perform brute-force attacks against the password reset mechanism. The /api/v1/users/reset-password endpoint fails to implement rate limiting, account lockouts, or code invalidation after failed attempts. An attacker can initiate a password reset request for a known email address and subsequently brute-force the six-digit verification code. If successful, the attacker can set a new password for the target account, resulting in full account takeover, including administrative accounts.

Impact

The vulnerability poses a severe risk to organizational security, as it allows for the takeover of any account, including administrative and service accounts, within a Databasus deployment. Successful exploitation leads to full unauthorized access to database configurations, user data, and potential lateral movement within the network or cloud environment.

Recommendation

• Upgrade Databasus to version 3.62.0 or later immediately to patch the missing rate limiting logic.
• Monitor web server access logs for high-frequency POST requests to the /api/v1/users/reset-password endpoint originating from single source IP addresses.
• Implement temporary IP-based blocking at the WAF level for any client exceeding a reasonable threshold of requests to the password reset endpoint.
• Audit administrative account activity for suspicious password change events occurring outside of standard maintenance windows.