Executive brief
A security flaw in the PenguinMod backend service allows any registered user to take over other people's accounts. By exploiting a weakness in the password reset process, an attacker can change the password of any account, including administrators, without knowing the target's current credentials. This could lead to unauthorized access to private data, deletion of projects, or full disruption of the service.
Technical details
A NoSQL injection vulnerability exists in the password reset endpoint of PenguinMod-BackendApi due to improper input validation of the 'email' field in the POST body. The application fails to coerce the input to a string, allowing an attacker to pass a MongoDB query object (e.g., using $regex). The vulnerability occurs because the 'verifyPasswordResetState' function validates the attacker's own token, but the subsequent 'getUsernameByEmail' function uses the same injected query to identify the account for the password change. An attacker with a valid account and a single reset token can manipulate the query to match and reset the password of an arbitrary user, including administrative accounts. This issue is fixed in version 1.0.0.
Affected products
- PenguinMod PenguinMod-BackendApi < 1.0.0
Timeline
- 2026-05-18: advisory: GitHub Security Advisory GHSA-wwwc-jwrc-3pj8 published
- 2026-06-11: disclosed: CVE-2026-47181 published to NVD
- 2026-06-11: patched: Vulnerability addressed in version 1.0.0