A flaw in the /api/admin/sys-user/reset/password/ endpoint of feiyuchuixue sz-boot-parent allows an attacker to manipulate the userId parameter, causing the system to assign the account a known default password. This weakness, identified as CWE-1393, lets an adversary reset any user’s password without legitimate credentials, effectively hijacking the account and its privileges.

All beta releases of feiyuchuixue sz-boot-parent up to version 1.3.2, including releases 1.0.0 through 1.3.2, are affected. The product is distributed under the cpe:2.3:a:szadmin:sz-boot-parent namespace and is hosted on GitHub under the feiyuchuixue:sz-boot-parent repository.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but a public exploit exists and can be triggered remotely via the password reset API. An attacker with network access to the application can craft a request to the endpoint, force the reset, and then log in with the default password, gaining the target account’s privileges. No higher privileges or additional conditions are required, making the attack vector likely to be remote over HTTP or HTTPS.