CVE-2026-84699— Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
Quick assessment
Affected
Team Password Manager Team Password Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Team Password Manager 14.184.308 之前的版本未能在本地账户密码重置流程中强制实施身份验证要求。未认证的攻击者可以重置本地账户的密码，并以这些用户的身份进行身份验证，从而获得未经授权的访问权限。
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1079.001 T1557.001 · Name Resolution Poisoning and SMB Relay
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
Source: CVE Program / CVE List V5
Vulnerability Description
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Team Password Manager | Team Password Manager | 0 ~ 14.184.308 | - |
|
II. Public POCs for CVE-2026-84699
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84699
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84699 (1)
Security Blog Posts for CVE-2026-84699 (1)
Vendor Pages for CVE-2026-84699 (1)
IV. Related Vulnerabilities
Same weakness: CWE-640
-
CVE-2026-82487
Beetel 450TC3 password recovery -
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Acc -
CVE-2026-80196
Kimai before 2.58.0 Authentication Bypass via Password Reset -
CVE-2026-77264
Automation Web Platform <= 4.8.6 - Unauthenticated Authentic -
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun
V. Comments for CVE-2026-84699
No comments yet