Vendor
An unauthenticated account takeover vulnerability (CVE-2026-14364) in the TrueBooker plugin allows attackers to reset arbitrary user passwords due to missing identity validation.