Executive brief
The hosp_order hospital appointment system contains a critical flaw in its password recovery mechanism that allows attackers to reset any user's password without validating the verification code sent to their email. An attacker who knows a victim's email address can take over any account, gaining full access to patient appointment data and account credentials without any authentication.
Technical details
The vulnerability is an authentication bypass in the password recovery flow (CWE-620: Unverified Password Change). The root cause is in CommonUserController.java: the findPassword method stores a user object in the session immediately upon sending a reset email, before the verification code is validated. The updatePassword method then only checks for the presence of userMSG in the session and proceeds to change the password, never requiring the victim to submit or validate the emailed reset code. An unauthenticated remote attacker can call findPassword with any known email address, then immediately call updatePassword with a new password, completely bypassing the intended out-of-band verification control. This requires only knowledge of a victim's email address and no authentication credentials. While a CVSS 9.1 score has been reported in the issue tracker, the advisory lists 6.5; given the complete account takeover impact, higher severity is warranted.
Affected products
- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
Timeline
- 2026-07-22: disclosed: Issue #113 opened on GitHub
- 2026-09-07: disclosed: CVE-2026-86260 published to NVD