Databasus versions 3.7.0 through 3.61.0 contain an authentication bypass that permits unauthenticated attackers to retrieve a six‑digit password reset code for a known email address via POST /api/v1/users/reset-password. Because the system provides no rate‑limiting, lockout, or code invalidation, an attacker can brute‑force the code and obtain account control, including administrative accounts. This flaw is a classic example of login‑session tampering (CWE‑307) and results in full account takeover, compromising confidentiality, integrity, and availability.

Vendors: Databasus. Product: Databasus application. Affected versions: 3.7.0 through 3.61.0. The vulnerability exists in the password‑reset code generation and validation logic of these releases.

The CVSS base score of 9.2 indicates a critical severity. The EPSS score is not available, so the precise exploitation probability is unknown, but the absence of rate limiting makes brute‑force attacks trivially feasible. The vulnerability is not catalogued in CISA KEV, yet the potential impact is high. Attackers can target any exposed instance over the network; the likely vector is remote over the internet via the application API, and no authentication is required to trigger the reset flow. Once the code is guessed, the attacker gains full access to the target account without further obstacles.