The Open eClass platform issues a password‑reset token that is intended to be single‑use. In versions older than 4.2 the token is not invalidated after the first successful password change, allowing a local attacker who has access to a valid token to use it again to set a new password for any account. This flaw directly undermines account integrity and is classified as CWE‑613, a failure to correctly invalidate a credential after use.

The vulnerability is present in the Open eClass platform supplied by gunet. All releases prior to version 4.2 are affected; the issue was remedied in the 4.2 release.

The CVSS score of 7.8 marks the flaw as high severity, while the EPSS score of less than 1% indicates a very low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a local attacker who can acquire a reset token can reuse it to take over an account, so the potential impact is significant if the attacker gains local or token access. The flaw can be exploited through a local attack vector that leverages the token reuse capability.