# CVE-2026-101041: vulnerability-lookup account recovery race condition and weak validation

Source: https://junglewise.ai/threats/cve-2026-101041-the-account-recovery-password-reset-functionality-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-101041 · Severity: info · Published 2026-09-27

The vulnerability-lookup web application's password reset feature contains two distinct security flaws in its user account recovery endpoint. First, a race condition allows attackers who possess a valid recovery token to exploit concurrent requests and set the target account's password to a value of their choosing, potentially overwriting a legitimate user's password change. Second, the same endpoint fails to validate password strength, allowing recovery tokens to set weak or empty passwords that bypass intended security constraints.

Technologies: [Vulnerability Lookup](https://junglewise.ai/threats/technologies/vulnerability-lookup). Vendors: [Vulnerability Lookup](https://junglewise.ai/threats/vendors/vulnerability-lookup).

## Quick answers

**Is CVE-2026-101041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101041 being exploited in the wild.

**How severe is CVE-2026-101041?** Informational severity, published 27 September 2026.

**Which products and versions are affected?** Vulnerability Lookup unspecified.

**Is there a fix for CVE-2026-101041?** A patch was published on 2026-09-26: Race condition fix in commit 5462bab62d76df852619e01eb67da36c023c8c40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101041 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101041?** Check whether you run Vulnerability Lookup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check-to-time-of-use (TOCTOU) race condition exists in the token consumption logic: the endpoint verifies the recovery token's nonce against the stored digest and then clears it in separate database transactions, allowing two concurrent requests with the same valid token to both pass verification before either commits, letting both set passwords. A secondary defect in the confirm_account view performs only manual field equality comparison and never invokes the form validator, bypassing minimum-length and complexity checks. The vulnerabilities are in website/models/user.py and website/web/views/user.py; the endpoint is /user/confirm_account/<token>. An attacker must possess a valid single-use recovery token, but no authentication is required to exploit either flaw.

## Affected products

- vulnerability-lookup vulnerability-lookup unspecified

## Timeline

- 2026-09-27: disclosed: CVE-2026-101041 published on NVD
- 2026-09-26: patched: Race condition fix in commit 5462bab62d76df852619e01eb67da36c023c8c40
- 2026-09-26: patched: Validation and token hardening in commit ad6f22882975516adf193a1a920aaa54025c71d4

## References

- [https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5462bab62d76df852619e01eb67da36c023c8c40](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5462bab62d76df852619e01eb67da36c023c8c40)
- [https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ad6f22882975516adf193a1a920aaa54025c71d4](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ad6f22882975516adf193a1a920aaa54025c71d4)

## Related threats

- [Vulnerability-Lookup webhook payload template DoS](https://junglewise.ai/threats/cve-2026-123660-in-vulnerability-lookup-5-5-1-up-to-but-not-including-6-4-1-a)
- [Vulnerability Lookup webhook SSRF bypass via IPv6 transition addresses](https://junglewise.ai/threats/cve-2026-72761-vulnerability-lookup-webhook-ssrf-bypass-via-ipv6-transition)