CVE-2026-28213
EUVD-2026-891126.02.2026, 23:16
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| evershop | evershop | 𝑥 < 2.1.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-640 - Weak Password Recovery Mechanism for Forgotten PasswordThe software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.