CVE-2026-22603: OpenProject has no protection against brute-force attacks in the Change Password function

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-10 · updated 2026-06-17
Weakness: CWE-307

Description

OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user’s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.

Affected products

opf openproject: before 16.6.2 — fixed in 16.6.2

How to fix

Upgrade to a fixed version: opf openproject 16.6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-22603 or the next vulnerability affects your stack