Executive brief
The zlt2000 microservices-platform is an enterprise microservices framework used to build multi-tenant systems with centralized user authentication. An authenticated attacker can bypass password verification checks and reset the password of any non-administrator user account, gaining complete control over those accounts without the victim's knowledge or consent.
Technical details
The vulnerability is an authentication bypass in the PUT /users/password endpoint caused by insufficient validation of password reset requests. The service controller accepts an arbitrary user ID from the request body and only checks that the target is not the admin account (id != 1), but fails to verify that the requester is the account owner or an administrator. Additionally, the password validation logic only performs old password verification if the old password field is non-empty, allowing attackers to omit it entirely to bypass the check. An authenticated user can supply any non-admin user ID and a new password to overwrite the target account's credentials. A proof-of-concept exploit has been publicly released on GitHub demonstrating account takeover (ATO) of victim accounts.
Affected products
- zlt2000 microservices-platform through 6.0.0
Timeline
- 2026-09-16: disclosed: CVE-2026-92467 published on NVD
- 2026-09-16: exploited: Public proof-of-concept exploit released on GitHub