{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28213", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T15:28:40.649Z", "datePublished": "2026-02-26T22:31:47.122Z", "dateUpdated": "2026-02-27T18:51:10.647Z"}, "containers": {"cna": {"title": "EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-640", "lang": "en", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw"}, {"name": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1"}], "affected": [{"vendor": "evershopcommerce", "product": "evershop", "versions": [{"version": "< 2.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:31:47.122Z"}, "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."}], "source": {"advisory": "GHSA-cg73-g723-39jw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T18:50:55.596307Z", "id": "CVE-2026-28213", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:51:10.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28213", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-27T18:50:55.596307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T18:51:02.524Z"}}], "cna": {"title": "EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response", "source": {"advisory": "GHSA-cg73-g723-39jw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "evershopcommerce", "product": "evershop", "versions": [{"status": "affected", "version": "< 2.1.1"}]}], "references": [{"url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw", "name": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1", "name": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:31:47.122Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28213", "state": "PUBLISHED", "dateUpdated": "2026-02-27T18:51:10.647Z", "dateReserved": "2026-02-25T15:28:40.649Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:31:47.122Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "454D1A1C-4946-4C6C-A2D8-B07AEF27E3E2", "versionEndExcluding": "2.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."}, {"lang": "es", "value": "EverShop es una plataforma de comercio electr\u00f3nico TypeScript-first. Versiones anteriores a la 2.1.1 tienen una vulnerabilidad en la funcionalidad de 'Olvid\u00e9 mi contrase\u00f1a'. Al especificar una direcci\u00f3n de correo electr\u00f3nico objetivo, la respuesta de la API devuelve el token de restablecimiento de contrase\u00f1a. Esto permite a un atacante tomar el control de la cuenta asociada. La versi\u00f3n 2.1.1 soluciona el problema."}], "id": "CVE-2026-28213", "lastModified": "2026-02-28T01:18:18.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-02-26T23:16:35.770", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-640"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-640"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.1)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "evershop", "source": "cna", "vendor": "evershopcommerce"}, "product": "evershop", "vendor": "evershop"}], "analysis": {"en": {"generated_at": "2026-04-16T15:57:31.144732+00:00", "value": {"mitigation_remediation": ["Upgrade EverShop to version\u202f2.1.1 or later, which removes the token from the password\u2011reset API response.", "Verify that subsequent password\u2011reset requests no longer return the reset token in the response payload or any public log output.", "Disable external password\u2011reset functionality or restrict it to internal use until the patch is applied, ensuring reset tokens are not exposed via the API.", "Implement monitoring of the reset endpoint for anomalous usage patterns and alert on frequent or repeated reset requests that could indicate exploitation attempts."], "summary": {"action": "Patch Immediately", "impact": "Account takeover"}, "threat_synthesis": {"affected_systems": "The vulnerability afflicts the evershopcommerce evershop platform in all releases earlier than version\u202f2.1.1. Users running those older builds are at risk, while version\u202f2.1.1 and later contain the fix.", "description_and_impact": "A flaw in EverShop's \"Forgot Password\" feature exposes the password reset token in the API response when an email address is supplied. This accidental disclosure allows an attacker to acquire a valid token and use it to access the associated customer account, effectively bypassing authentication. The weakness is a clear breach of information confidentiality (CWE\u2011200) and is exploited for account takeover (CWE\u2011640).", "risk_and_exploitability": "With a CVSS score of 9.8, the problem is of high severity. Although the EPSS score is reported as less than 1\u202f%, the exposure occurs over a public API, so remote attackers can trigger it without special privileges. The issue is not currently listed in the CISA KEV catalog, but its potential for immediate account compromise warrants urgent attention. The likely attack path is a simple HTTP request to the reset endpoint with any email address, followed by reuse of the visible token to log in as that user."}}}}, "created": "2026-02-27T09:03:53.888375+00:00", "updated": "2026-04-16T16:00:13.886509+00:00", "vendors": ["evershop", "evershop$PRODUCT$evershop"]}