A flaw in EverShop's "Forgot Password" feature exposes the password reset token in the API response when an email address is supplied. This accidental disclosure allows an attacker to acquire a valid token and use it to access the associated customer account, effectively bypassing authentication. The weakness is a clear breach of information confidentiality (CWE‑200) and is exploited for account takeover (CWE‑640).

The vulnerability afflicts the evershopcommerce evershop platform in all releases earlier than version 2.1.1. Users running those older builds are at risk, while version 2.1.1 and later contain the fix.

With a CVSS score of 9.8, the problem is of high severity. Although the EPSS score is reported as less than 1 %, the exposure occurs over a public API, so remote attackers can trigger it without special privileges. The issue is not currently listed in the CISA KEV catalog, but its potential for immediate account compromise warrants urgent attention. The likely attack path is a simple HTTP request to the reset endpoint with any email address, followed by reuse of the visible token to log in as that user.