CVE-2025-56676

CVE-2025-56676 is a medium-severity vulnerability in Titansystems Zender with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1259.

Key facts

Description

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.

Frequently asked questions

What is CVE-2025-56676?
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.
How severe is CVE-2025-56676?
CVE-2025-56676 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity none, and availability low.
Is CVE-2025-56676 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-56676?
CVE-2025-56676 affects Titansystems Zender. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-56676?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-56676 have an EU (EUVD) identifier?
Yes. CVE-2025-56676 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-31752.
When was CVE-2025-56676 published?
CVE-2025-56676 was published on 2025-09-30 and last updated on 2026-06-17.

References

Affected products (1)

Other CWE-1259 vulnerabilities

Browse all CWE-1259 vulnerabilities →