Executive brief
Badaso is a Laravel-based admin panel and content management framework used to build backend dashboards and APIs. A flaw in its password reset functionality allows attackers to easily guess password reset tokens and take over any user account, including admin accounts, within hours. The vulnerability combines weak token generation (only ~890k possibilities), no token expiration, and no rate limiting, making account takeover trivial.
Technical details
The vulnerability is an authentication bypass in the password reset token generation mechanism. The forgetPassword() function in BadasoAuthController.php uses PHP's insecure rand() function to generate 6-digit tokens (range 111111–999999), yielding only ~890k possible values instead of cryptographically strong randomness. Additionally, tokens never expire—verification checks only confirm the token exists in the database, not its age. Combined with the absence of rate limiting on the reset-password endpoint, an attacker can brute-force any user's token in ~3–7 hours at ~33 requests/second. The same weak token generation affects email verification functions, expanding the attack surface.
Affected products
- Uasoft Badaso up to 2.9.7
Timeline
- 2025-12-31: disclosed: Vulnerability disclosed publicly
- 2025-12-31: advisory