Cpe:2.3:a:databasus:databasus:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3adatabasusdatabasus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 20:33:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in Databasus via Reset Password Brute-Forcinghttps://feed.craftedsignal.io/briefs/2026-10-databasus-auth-bypass/Wed, 14 Oct 2026 20:33:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-databasus-auth-bypass/An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.Databasus versions 3.7.0 through 3.61.0 are affected by an authentication bypass vulnerability (CVE-2026-110770) that allows unauthenticated attackers to perform brute-force attacks against the password reset mechanism. The /api/v1/users/reset-password endpoint fails to implement rate limiting, account lockouts, or code invalidation after failed attempts. An attacker can initiate a password reset request for a known email address and subsequently brute-force the six-digit verification code. If successful, the attacker can set a new password for the target account, resulting in full account takeover, including administrative accounts.

Impact

The vulnerability poses a severe risk to organizational security, as it allows for the takeover of any account, including administrative and service accounts, within a Databasus deployment. Successful exploitation leads to full unauthorized access to database configurations, user data, and potential lateral movement within the network or cloud environment.

Recommendation

  • Upgrade Databasus to version 3.62.0 or later immediately to patch the missing rate limiting logic.
  • Monitor web server access logs for high-frequency POST requests to the /api/v1/users/reset-password endpoint originating from single source IP addresses.
  • Implement temporary IP-based blocking at the WAF level for any client exceeding a reasonable threshold of requests to the password reset endpoint.
  • Audit administrative account activity for suspicious password change events occurring outside of standard maintenance windows.
]]>highadvisorycredential-accessauthentication-bypassweb-application-security