Executive brief
Gladys Assistant, a home automation and smart home management platform, contains a vulnerability in its password reset mechanism that allows attackers to trick users into clicking poisoned reset links. When a user forgets their password, the system generates a reset link but fails to validate where that link came from. An attacker can craft a malicious request that causes the victim to receive a reset link pointing to the attacker's server, capturing the session token and gaining full control of any account, including administrator accounts.
Technical details
The forgot_password endpoint accepts a client-supplied origin parameter without server-side validation, enabling password reset link poisoning. An unauthenticated attacker can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a reset link that discloses the session token to the attacker. This allows full account takeover including administrator-level access. The vulnerability was patched in version 5.1.0 (commit #3120) by implementing proper origin validation.
Affected products
- Gladys Gladys Assistant before 5.1.0
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in v5.1.0 via PR #3120