# CVE-2026-86260: sfturing hosp_order auth bypass in password recovery

Source: https://junglewise.ai/threats/cve-2026-86260-sfturing-hosp-order-auth-bypass-in-password-recovery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86260 · Severity: medium · CVSS 6.5 · Published 2026-09-07

The hosp_order hospital appointment system contains a critical flaw in its password recovery mechanism that allows attackers to reset any user's password without validating the verification code sent to their email. An attacker who knows a victim's email address can take over any account, gaining full access to patient appointment data and account credentials without any authentication.

Technologies: [Sfturing Hosp Order](https://junglewise.ai/threats/technologies/hosp-order). Vendors: [Sfturing](https://junglewise.ai/threats/vendors/sfturing).

## Quick answers

**Is CVE-2026-86260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86260 being exploited in the wild.

**How severe is CVE-2026-86260?** Medium severity, with a CVSS score of 6.5, published 7 September 2026.

**Which products and versions are affected?** Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

**Is there a fix for CVE-2026-86260?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86260 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86260?** Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the password recovery flow (CWE-620: Unverified Password Change). The root cause is in CommonUserController.java: the findPassword method stores a user object in the session immediately upon sending a reset email, before the verification code is validated. The updatePassword method then only checks for the presence of userMSG in the session and proceeds to change the password, never requiring the victim to submit or validate the emailed reset code. An unauthenticated remote attacker can call findPassword with any known email address, then immediately call updatePassword with a new password, completely bypassing the intended out-of-band verification control. This requires only knowledge of a victim's email address and no authentication credentials. While a CVSS 9.1 score has been reported in the issue tracker, the advisory lists 6.5; given the complete account takeover impact, higher severity is warranted.

## Affected products

- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

## Timeline

- 2026-07-22: disclosed: Issue #113 opened on GitHub
- 2026-09-07: disclosed: CVE-2026-86260 published to NVD

## References

- [https://github.com/sfturing/hosp_order/](https://github.com/sfturing/hosp_order/)
- [https://github.com/sfturing/hosp_order/issues/113](https://github.com/sfturing/hosp_order/issues/113)

## Related threats

- [sfturing hosp_order CSRF in user profile modification endpoints](https://junglewise.ai/threats/cve-2026-96551-a-vulnerability-was-determined-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order hard-coded credentials in configuration](https://junglewise.ai/threats/cve-2026-96548-a-flaw-has-been-found-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order reflected XSS in public search parameters](https://junglewise.ai/threats/cve-2026-95396-a-vulnerability-was-identified-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order authorization bypass in order cancellation](https://junglewise.ai/threats/cve-2026-86263-sfturing-hosp-order-authorization-bypass-in-order-cancellation)
- [sfturing hosp_order authorization bypass in Order Handler](https://junglewise.ai/threats/cve-2026-86262-sfturing-hosp-order-authorization-bypass-in-order-handler)