The vulnerability lies in the password recovery component of the vtenext application. A hacker who can determine a valid username may send a request to hub/rpwd.php with action=change_password. Because the script does not validate a token, the system accepts the request and updates the user’s password without any credential checks. This allows an unauthenticated attacker to set a new password for any account, including those with administrative rights, especially if two‑factor authentication is not enabled. The result is a full account takeover and potential compromise of the entire system.

The issue affects the vtenext CRM product. Versions 25.02 and any releases prior to 25.02.1 are impacted. The vulnerability is tied to the hub/rpwd.php script that processes password change requests.

The CVSS score of 9.3 marks this flaw as critical. EPSS is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. Attackers who know a valid username can call hub/rpwd.php with action=change_password, bypassing token verification, and set a new password. Because the mechanism skips authentication checks, anyone can assume any user’s credentials. If the target account has administrative rights or lacks 2‑factor authentication, the attacker can gain unrestricted control of the system. The flaw can be triggered from outside the application over HTTP, making it remotely exploitable.