Excessive Password Reset Requests in Alosuite by AM Systems

CVE-2026-108048

What is CVE-2026-108048?

The password recovery functionality in Alosuite is vulnerable due to inadequate request limits on the '/Account/resetPwd' endpoint. This flaw allows attackers to exploit the password recovery mechanism by making an unlimited number of requests to generate reset emails for a target account. The absence of restrictions can lead to an inundation of automated reset emails, overwhelming users' inboxes and consuming application and email server resources. Consequently, this vulnerability not only disrupts legitimate user experience but also exposes the system to potential abuse through automated attacks.

References