Executive brief
MyComplianceOffice (MCO) is a compliance management platform used by financial services and investment firms to manage regulatory obligations. A flaw in its password reset process allows an attacker to repeatedly lock legitimate users out of their accounts. By knowing a user's email and correctly guessing their security question, an attacker can trigger a reset that immediately invalidates the user's current password, causing a denial of service for that account.
Technical details
The MCO application (confirmed in version 25.3.3.1) suffers from an improper restriction of excessive authentication attempts (CWE-307) and a weak password recovery mechanism (CWE-640). The password reset logic is designed such that initiating a reset request immediately invalidates the user's current password and any previously issued temporary passwords. Because there is no rate limiting on these requests, an attacker who knows a victim's email and can answer their security question can continuously trigger resets to keep the victim locked out. While security questions have a limited number of attempts, a successful guess allows for persistent account denial of service. No patch is currently confirmed as vendor contact attempts were unsuccessful.
Affected products
- MyComplianceOffice MCO 25.3.3.1
Timeline
- 2026-07-01: disclosed: Disclosed by CERT.PL after unsuccessful vendor contact attempts.
- 2026-07-01: advisory