CVE-2026-107640 Details
Description
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
A vulnerability allowing authentication bypass has been identified in Integrics Enswitch versions 3.13 through 4.4. The issue resides in the password update API endpoint, where unauthenticated attackers can change account passwords by omitting the reset parameter. This vulnerability targets accounts with no pending password reset, specifically those whose reset key is empty, allowing attackers to take over administrator accounts after username enumeration.
Users are advised to update to Enswitch versions 3.13 to 4.3 (Subversion revision 21680 or later) or Enswitch 4.4 (Git commit c2c981578 or later). If the update cannot be applied immediately, restrict access to the password update API endpoint to trusted clients or temporarily block the route.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Integrics Enswitch | >= 3.13, <= 4.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |