CVE-2026-34408 Details
Description
An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known.
A vulnerability in Gambio version 4.9.2.0 has been identified, allowing the password reset function to be bypassed. This issue enables users to set arbitrary passwords for any account, provided the account ID is known. The vulnerability arises because the password reset token validation can be circumvented by inserting a space character, effectively exploiting the token verification process.
Users can update to Gambio version 4.9.2.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2026CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://herolab.usd.de/security-advisories/usd-2024-0002/ | [email protected] | AdvisoryExploitRemedy |
| https://www.gambio.de/forum/threads/wichtiges-security-update-2024-02-v1-0-fuer-gx4-v4-0-0-0-bis-v4-9-2-0.50896/ | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Gambio | 4.9.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |