Databasus API Flaw Allows Unrestricted Brute-Force of Password Reset Codes

Databasus versions 3.7.0 through 3.61.0 contain a critical authentication bypass flaw. Attackers can exploit this to take over user and administrator accounts by guessing password reset codes without restriction.

What happened

The National Vulnerability Database records CVE-2026-110770 as a critical issue. It stems from an authentication bypass weakness, classified under CWE-307. The flaw exists in Databasus releases from version 3.7.0 up to and including 3.61.0. An unauthenticated attacker can target the POST /api/v1/users/reset-password endpoint. They can request a six-digit code for any known email address. The system then allows the attacker to guess this code repeatedly. There is no rate limiting, account lockout, or code invalidation in place. This lack of controls enables successful brute-force attacks. Consequently, attackers can reset passwords and seize control of accounts, including administrative ones.

Why it matters

This vulnerability grants unauthenticated access to a critical account recovery function. The absence of standard security controls like rate limiting makes automated attacks trivial. Attackers do not need valid credentials to initiate the attack. They only need a valid email address associated with an account. Once the six-digit code is guessed, they can reset the password. This leads to complete account compromise. Administrative accounts are equally exposed to this risk. The high CVSS score of 9.2 reflects the severity of this unauthenticated takeover vector.

Next steps

• Verify if your Databasus installation is version 3.7.0 through 3.61.0.
• Monitor logs for excessive requests to the password reset API endpoint.
• Check for successful password resets from unusual sources or times.
• Ensure administrative accounts have additional verification steps if possible.

Detection notes

Security teams should monitor for high volumes of requests to the password reset endpoint. Look for repeated failures followed by a successful reset event. Check for resets initiated from new or unusual IP addresses. Analyse logs for patterns indicating automated guessing tools. Implement alerts for multiple reset attempts from a single source. Review access logs for accounts that were reset and then accessed immediately. Ensure logging captures both the request source and the outcome. This helps identify brute-force patterns before full compromise occurs.

Background: Account takeover

You prevent account takeover by enforcing multi-factor authentication with hardware tokens, monitoring for impossible travel, and binding sessions to device fingerprints. Passwords alone cannot stop this threat. You must verify the user’s identity and the device’s integrity at every login, not just at the start of the session.

Read the full guide: How to Prevent Account Takeover: The Technical Controls That Actually Work

What to do and how to stay safe: Databasus

• Check your Databasus version to see if it falls within the affected range.
• Monitor web server logs for unusual activity on the reset-password endpoint.
• Review account access logs for signs of unauthorized password changes.
• Once the vendor provides an update, apply it immediately to mitigate the risk.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Databasus versions are affected by CVE-2026-110770?

Versions 3.7.0 through 3.61.0 are affected by this authentication bypass vulnerability.

What is the CVSS score for this vulnerability?

The CVSS score for CVE-2026-110770 is 9.2, which is rated as critical.

How do attackers exploit this flaw?

Attackers request a reset code for a known email and brute-force the six-digit code.