The vulnerability allows unauthenticated attackers to craft a request to the forgot_password endpoint, including an attacker‑controlled origin header that the server trusts. The resulting password reset link contains the real password reset token, which leaks the session token to the attacker. This enables the attacker to compromise any account, including administrator accounts, without needing valid credentials.

Any installation of Gladys Assistant with a version earlier than 5.1.0 is affected. The vendor defines the affected product as Gladys Assistant: Gladys Assistant. Specific version numbers are not listed beyond the <5.1.0 threshold.

The CVSS score of 7.4 indicates a high severity. EPSS is not available, so the probability of exploitation can only be inferred from the nature of the flaw. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote unauthenticated HTTP requests to the forgot_password endpoint, which can be triggered from any network connected to the application. Because the vulnerability allows the attacker complete account takeover, it presents a significant risk to confidentiality, integrity, and availability of the affected services.