CVE-2026-77172

MediumCVSS 5.3

Published: 27/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

App passwords were allowed to bypass password confirmation on sensitive endpoints. This enabled sensitive operations to be performed without re-authentication.

Risk Assessment

Bypassing password confirmation weakens protection of sensitive operations and may help an attacker exploit a stolen app password. This increases the risk of unauthorized account changes.

Recommendation

Update the application to a version with a fix that enforces password confirmation on sensitive endpoints for app passwords as well. Consider reviewing and revoking existing app passwords.

Other vulnerabilities in Authentication

CVE-2026-2402Medium
A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to a user account by performing an arbitrary number of authentication attempts with different credentials across a sequence of requests to multiple endpoints.

Original NVD description (English source)

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS