# CVE-2026-94380: HAVELSAN Liman MYS weak password recovery mechanism

Source: https://junglewise.ai/threats/cve-2026-94380-weak-password-recovery-mechanism-for-forgotten-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-94380 · Severity: high · CVSS 8.1 · Published 2026-10-26

Liman MYS is a centralized IT management platform used by organizations to manage infrastructure and endpoints. A weakness in its password recovery process allows attackers to bypass authentication and reset user passwords without proper verification, potentially gaining unauthorized access to administrative accounts and the entire managed infrastructure.

Technologies: [HAVELSAN Liman MYS](https://junglewise.ai/threats/technologies/liman-mys). Vendors: [HAVELSAN](https://junglewise.ai/threats/vendors/havelsan).

## Quick answers

**Is CVE-2026-94380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94380 being exploited in the wild.

**How severe is CVE-2026-94380?** High severity, with a CVSS score of 8.1, published 26 October 2026.

**Which products and versions are affected?** HAVELSAN Liman MYS 2.3.4-1124 through 2.3.5-1130.

**Is there a fix for CVE-2026-94380?** Yes: fixed in 2.3.5-1131. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94380 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94380?** Check whether you run HAVELSAN Liman MYS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.5-1131

## Technical details

A weak password recovery mechanism in the forgotten password feature fails to properly validate recovery requests, allowing attackers to manipulate or bypass security checks. The vulnerability affects versions 2.3.4-1124 through 2.3.5-1130 and requires network access to the password recovery endpoint. An attacker can exploit this to reset passwords for valid user accounts, including high-privileged administrators.

## Affected products

- HAVELSAN Liman MYS 2.3.4-1124 through 2.3.5-1130

## Timeline

- 2026-10-26: disclosed

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1396](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1396)

## Related threats

- [HAVELSAN Liman MYS path traversal](https://junglewise.ai/threats/cve-2026-105457-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [HAVELSAN Liman MYS path traversal](https://junglewise.ai/threats/cve-2026-19532-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [HAVELSAN Liman MYS LDAP injection](https://junglewise.ai/threats/cve-2026-13696-havelsan-liman-mys-ldap-injection)
- [HAVELSAN Liman MYS improper cryptographic signature verification](https://junglewise.ai/threats/cve-2026-11348-havelsan-liman-mys-improper-cryptographic-signature-verification)
- [HAVELSAN Liman MYS missing authorization in ACLs](https://junglewise.ai/threats/cve-2026-11340-havelsan-liman-mys-missing-authorization-in-acls)