Unauthenticated Account Takeover via Password Reset Token in EMSigner v2.8.7

CVE-2023-43902 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.

Learn more about our User Device Pen Test.