The vulnerability allows a user to change their password without providing the current password when a valid session token is supplied. This means an attacker who has previously obtained a session token can reset any user’s password and maintain access to the account, including administrator accounts, thereby achieving persistence and preventing legitimate users from accessing the account. The weakness lies in improper authentication validation, identified as CWE‑620.

OpenC3 COSMOS v6.x releases prior to 6.10.5 and v7.x releases prior to 7.0.0‑rc3 are affected. The issue is resolved in version 6.10.5 and 7.0.0‑rc3 and later.

With a CVSS score of 8.1 the vulnerability is rated high, and while the EPSS score is unavailable, the absence from the CISA KEV list suggests it has not yet been widely exploited. Attackers require a valid session token, which can be obtained through session hijacking or other credential theft methods. The exploitation path is therefore restricted to users who have already been authenticated or whose session has been compromised. Despite this limitation the impact of gaining unrestricted account access is significant and warrants immediate attention.