Quick answers
- Is CVE-2026-6285 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6285 being exploited in the wild.
- How severe is CVE-2026-6285?
- High severity, with a CVSS score of 7.5, published 10 September 2026.
- Which products and versions are affected?
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 before 18.9.26.2319.
- Is there a fix for CVE-2026-6285?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6285 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-6285?
- Check whether you run Ankaref Innovation and Technology Inc. LIBRID/LIBREF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a weak password recovery mechanism in the forgotten password functionality of LIBRID/LIBREF. The password reset process lacks adequate security controls or validation checks, allowing attackers to exploit the recovery flow to reset passwords for any user account. This could be achieved through predictable tokens, insufficient verification, or other flaws in the recovery workflow. The issue affects versions 2.01.0.2183 through versions prior to 18.9.26.2319. Organizations using vulnerable versions should update immediately to patch this authentication bypass vector.
Affected products
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 before 18.9.26.2319
Timeline
- 2026-09-10: disclosed