CVE-2025-56676

MEDIUM EPSS 22.4%
Published Sep 30, 20259mo ago · Modified Jun 17, 20261w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Sep 30, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure.

CVSS Details

Base Score
5.4
Exploitability
2.8
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability Low

Threat Intelligence

EPSS Exploit Probability
22.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-1259

Affected Products 1

VendorProductVersionRange
titansystemszender3.9.7any

References 3

  • codecanyon.net https://codecanyon.net/item/zender-android-mobile-devices-as-sms-gateway-saas-platform/26594230
    Product
  • darklotus.medium.com https://darklotus.medium.com/cve-2025-56676-critical-vulnerability-in-zender-gateway-allows-account-takeover-2b5bcb50c762
    Third Party Advisory
  • previews.titansystems.ph https://previews.titansystems.ph/zender/dashboard/auth
    Permissions Required

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.