CWE-620— Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.— MITRE CWE catalog
108 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-620page 3 of 3
- CVE-2025-3793MEDIUMCVSS 4.2EG 4.22025-04-24
The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' fun…
- CVE-2024-23637MEDIUMCVSS 4.2EG 4.22024-01-31
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repea…
- CVE-2025-47938LOWCVSS 3.8EG 3.82025-05-20
TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, the backend user management interface allows password …
- CVE-2024-2213LOWCVSS 3.3EG 3.32024-06-06
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current…
- CVE-2026-9249LOWCVSS 3.1EG 3.12026-05-26
Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 202…
- CVE-2026-2543LOWCVSS 2.7EG 2.72026-02-16
A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverifie…
- CVE-2025-46748LOWCVSS 2.7EG 2.72025-05-12
An authenticated user attempting to change their password could do so without using the current password.
- CVE-2024-47784LOWCVSS 2.6EG 2.62025-04-30
Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI This issue affects ANC software version 1.1.4 and earlier.
Map vulnerabilities like CWE-620 to your infrastructure
EchelonGraph correlates every CVE — across CWE-620 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →