关键漏洞信息 漏洞标题: Account Takeover Through Unvalidated Username in Password Reset Workflow 漏洞严重程度: High CVSS评分: 8.7 / 10 受影响版本: >=5.0, <=5.7 修复版本: 5.8 CVE ID: CVE-2025-66225 漏洞描述: The password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset link for any account they can receive email for, an attacker can alter the username parameter in the final reset request to target a different user. Because the system accepts the supplied username without verification, the attacker can set a new password for any chosen account, including privileged accounts, resulting in full account takeover. CVSS v4 Base Metrics: Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privileges Required: Low User Interaction: None Vulnerable System Impact Metrics: Confidentiality: High Integrity: High Availability: High Subsequent System Impact Metrics: Confidentiality: None Integrity: None Availability: None