Account Takeover Vulnerability in OpenAEV Platform

CVE-2026-24467

What is CVE-2026-24467?

The OpenAEV platform, a powerful tool for cyber adversary simulations, has a significant vulnerability in its password reset functionality. The flaw allows unauthorized access to user accounts due to persistent password reset tokens that do not expire. Attackers can exploit this design issue to generate a multitude of valid tokens, enabling them to brute-force attempts on user accounts without needing prior authentication. This vulnerability can lead to full account compromise, allowing unauthorized access to sensitive simulation data. Users are advised to upgrade to version 2.0.13 immediately to mitigate this risk.

References