CVE-2026-108048

The record

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

Affected packages

Related vulnerabilities

• CVE-2026-116646 Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response. CWE-770
• CVE-2026-111751 Angular is a development platform for building mobile and desktop web applications using… CWE-770
• CVE-2026-63501 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-770
• CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead… CWE-770
• CVE-2026-115716 Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to… CWE-770
• CVE-2026-118487 In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in… CWE-770
• CVE-2026-108147 An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13… CWE-770
• CVE-2026-121412 FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption… CWE-770