Password reset tokens in Fleet remain valid for 24 hours even after the user changes their password. An attacker who already has a valid token can use it to reset the account password after a user has taken defensive action, effectively bypassing the password change. This vulnerability, classified as CWE‑613, allows unauthorized account takeover and can jeopardize the confidentiality and integrity of the affected user’s account.

Fleet by fleetdm is the only vendor listed for this issue. The vulnerability exists in all releases prior to 4.81.0. Users running Fleet 4.80.x and earlier are potentially exposed. Versions 4.81.0 and newer contain a fix that invalidates reset tokens immediately upon password change.

The CVSS score of 6.0 indicates a moderate impact; however, the exploit does not require specialized skills, only a valid token. The EPSS score is not available, and the vulnerability is not currently in CISA’s KEV catalog. The likely attack vector is an attacker with a stale reset token, which may be intercepted via email or other channels. Once the token is used, the attacker can set a new password and gain full control of the account.