CVE-2026-104468: YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-02
Weakness: CWE-613

Description

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.

Affected products

yeswiki: before 4.6.7 — fixed in 4.6.7

How to fix

Upgrade to a fixed version: yeswiki 4.6.7. Check the vendor advisory for mitigations.

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-non-expiring-password-reset-tokens-via-lostpasswordaction
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x3xh-4hx3-rgm7

Get alerted when CVE-2026-104468 or the next vulnerability affects your stack