Unauthenticated Account Takeover in MacCMS via Password Recovery Rate Limiting Bypass

MacCMS versions v10 through 2026.1000.4056 contain a critical vulnerability in the password recovery mechanism that fails to enforce rate limiting on six-digit recovery codes. This flaw allows an unauthenticated attacker to abuse the 'findpass_reset' function by systematically brute-forcing the verification code required to reset a user's password. An attacker requires only the target's associated email address or phone number to initiate the recovery workflow. Once the correct six-digit code is guessed, the attacker can overwrite the member's existing password, leading to complete account takeover. This vulnerability is particularly impactful in multi-user environments where member account security is essential.

Impact

The vulnerability poses a high risk of unauthorized account access, potentially leading to data exfiltration, account impersonation, and unauthorized administrative actions within the MacCMS application. Given the ubiquity of CMS platforms, any site running vulnerable versions is susceptible to automated account takeover campaigns.

Recommendation

• Monitor web access logs for high-frequency POST requests to the 'findpass_reset' endpoint from a single source IP address, which may indicate automated brute-force attempts.
• Implement rate limiting or account lockout policies at the web application firewall (WAF) or web server level for the password recovery module.
• Upgrade MacCMS to a patched version beyond 2026.1000.4056 as soon as the vendor provides a remediation.
• Audit user account logs for suspicious password resets that do not correspond with user-initiated activity.