Authentication Weakness in Vulnerability-Lookup's Account Activation and Password Recovery Mechanism

CVE-2026-73431

What is CVE-2026-73431?

Vulnerability-Lookup exhibits an authentication weakness within its account activation and password recovery procedures. The application leverages stateless signed tokens to generate activation and recovery links containing merely the user's login information. Although the system verifies the token's signature and its age, it lacks a mechanism to track the successful usage of a token. Consequently, an attacker who intercepts a valid activation or recovery link can exploit it multiple times throughout its validity period, even after the associated password has been modified. Furthermore, the inadequacy of binding tokens to specific actions permits the same mechanism to serve both activation and recovery functions. To address these issues, a security patch has been implemented, introducing purpose-bound tokens alongside a randomly generated nonce stored securely with the user account. This improvement ensures that tokens are single-use; once an action is performed, the nonce is invalidated, and subsequent tokens issued negate any previous ones. The updated process mandates the token's consumption before finalizing any account alterations.

References