CVE-2026-53904— MyComplianceOffice MCO 授权问题漏洞

Account Denial of Service in MCO

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset process and continuously invalidate credentials, effectively locking the victim out of their account. Answering security questions has a limited number of tries which lowers the risk of this vulnerability. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

过多认证尝试的限制不恰当

MyComplianceOffice MCO 授权问题漏洞

MyComplianceOffice MCO是MyComplianceOffice公司的一款合规与风险管理软件。 MyComplianceOffice MCO 25.3.3.1版本存在授权问题漏洞，该漏洞源于密码重置功能实现不当，可能导致攻击者通过提供受害者的电子邮件和安全问题答案发起重置请求，持续作废凭证，造成账户拒绝服务。

N/A

N/A