The vulnerability stems from a flaw in Fleet's password reset mechanism that allows a password reset token, once issued, to remain valid for 24 hours even after the account holder changes their password. This failure to invalidate stale tokens means that anyone in possession of a previously issued token can use it to reset the account password to any value they choose, effectively bypassing the recent password change. The weakness is classified as CWE‑613, an exception handling failure. The result is a loss of account integrity and the potential for complete account takeover, though it does not directly compromise other data or system availability.

The issue affects the open‑source Fleet device‑management platform provided by FleetDM. Versions of Fleet prior to 4.81.0 are vulnerable; Fleet 4.81.0 and later contain the fix.

The CVSS score of 6 indicates a medium severity vulnerability, and the EPSS score of less than 1 percent suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires possession of a valid, but stale, password reset token. The likely attack vector is remote, as the token can be used over the network once obtained, perhaps via phishing or a prior breach. Once the token is in hand, the attacker can reset the password without additional authentication, leading to full control over the affected account.