Authentication tokens used for account activation and password recovery were stateless and only bound to the user’s login. The signature and expiration were verified, but the system did not record whether a token had already been used. Consequently, an attacker who captured a valid activation or recovery link could replay it any number of times during the configured validity period, setting a new password and repeatedly regaining control of the account. Tokens were also not tied to a specific purpose, allowing the same mechanism to be abused across activation and recovery workflows. The weakness corresponds to CWE‑294: Unchecked Return Value Should Either Return Itself or Indicate Failure.

The vulnerability affects the product vulnerability‑lookup by vulnerability‑lookup. No specific version information is provided in the data.

The flaw is marked with a CVSS score of 8.8, indicating high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. Successful exploitation requires only possession of a valid activation or recovery link; no knowledge of the victim’s password or an authenticated session is needed. The likely attack vector is interception or theft of the link, for example through phishing or traffic capture, after which the attacker can repeatedly use the link until it expires.