{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/databasus/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:databasus:databasus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Databasus (3.7.0-3.61.0)"],"_cs_severities":["high"],"_cs_tags":["credential-access","authentication-bypass","web-application-security"],"_cs_type":"advisory","_cs_vendors":["Databasus"],"content_html":"\u003cp\u003eDatabasus versions 3.7.0 through 3.61.0 are affected by an authentication bypass vulnerability (CVE-2026-110770) that allows unauthenticated attackers to perform brute-force attacks against the password reset mechanism. The /api/v1/users/reset-password endpoint fails to implement rate limiting, account lockouts, or code invalidation after failed attempts. An attacker can initiate a password reset request for a known email address and subsequently brute-force the six-digit verification code. If successful, the attacker can set a new password for the target account, resulting in full account takeover, including administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a severe risk to organizational security, as it allows for the takeover of any account, including administrative and service accounts, within a Databasus deployment. Successful exploitation leads to full unauthorized access to database configurations, user data, and potential lateral movement within the network or cloud environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Databasus to version 3.62.0 or later immediately to patch the missing rate limiting logic.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for high-frequency POST requests to the /api/v1/users/reset-password endpoint originating from single source IP addresses.\u003c/li\u003e\n\u003cli\u003eImplement temporary IP-based blocking at the WAF level for any client exceeding a reasonable threshold of requests to the password reset endpoint.\u003c/li\u003e\n\u003cli\u003eAudit administrative account activity for suspicious password change events occurring outside of standard maintenance windows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T20:33:18Z","date_published":"2026-10-14T20:33:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-databasus-auth-bypass/","summary":"An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.","title":"Authentication Bypass in Databasus via Reset Password Brute-Forcing","url":"https://feed.craftedsignal.io/briefs/2026-10-databasus-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Databasus","version":"https://jsonfeed.org/version/1.1"}