Concrete CMS versions below 9.5.3 store hashes used for email verification, password resets, and persistent logins in one table with a type column and look up a hash value alone. The flaw lets an attacker supply a registration hash to the password‑change endpoint, effectively resetting the owner’s password, or use a password‑reset hash on the email‑validation endpoint to activate an account. The vulnerability only compounds the risk of any hash disclosure, so it amplifies the impact of compromised hashes.

Concrete CMS deployments running any version earlier than 9.5.3 are vulnerable. The flaw affects the core authentication subsystem across all site installations that use the default validation‑hash table setup.

The CVSS v4.0 score of 6.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to first obtain a valid hash through a separate channel such as email interception, log exposure, or server‑side request forgery against an internal mail relay. Once a hash is available, the attacker can reuse it for a different purpose, allowing account compromise without additional credentials. The likely attack vector is indirect, relying on first‑stage hash disclosure, but the cost of the subsequent takeover is significant.