Account Takeover Vulnerability in Hitachi’s Administration API

CVE-2026-108337

What is CVE-2026-108337?

An administrator has the capability to extract password reset codes for any user through an oversight in the Administration API. This vulnerability permits an authorized admin to gain control over other users' accounts by utilizing these codes. The flaw is restricted to admin users; however, any admin with this access can potentially compromise the security of other account holders. While device credentials and customer data remain safeguarded, the ability to reset passwords poses a significant risk to user accounts.

References