OpenAEV's password reset tokens never expire and are only eight digits long. An attacker can generate large numbers of valid tokens and then brute‑force them. Because the system exposes user email addresses to other users, the attacker only needs the target’s email to begin the process. The attacker can reset any registered user’s password without authentication, granting full control over the account and, as described, the entire platform. This enables modification of simulation data and compromise of all hosts with installed agents, effectively changing scope from a single account to system‑wide compromise.

OpenAEV Platform, versions 1.0.0 through 2.0.12 inclusive. The fix is included in the 2.0.13 release.

The CVSS score of 9.1 indicates critical severity. The EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out entirely over the network from an unauthenticated external host by requesting a reset token, collecting many tokens, and then brute‑forcing at up to 100 requests per second. No privileged access is required and email configuration is irrelevant, so any deployed OpenAEV instance is at risk.