CVE-2026-10169 Overview
CVE-2026-10169 is a weak password recovery vulnerability [CWE-640] in the OUSL-GROUP-BrinaryBrains School Student Management System. The flaw resides in the ajax_forgot_password function within application/controllers/Login.php, which handles the Forgot Password endpoint. An unauthenticated attacker can manipulate the email argument to abuse the password recovery mechanism remotely. The project does not use versioning, so all releases up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 are affected. A public exploit exists, though exploitation is reported as high complexity. The maintainers received an issue report but have not yet responded.
Critical Impact
Remote attackers can abuse the password recovery workflow to compromise account integrity, though exploitation requires meeting high-complexity conditions.
Affected Products
- OUSL-GROUP-BrinaryBrains School Student Management System up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6
- Vulnerable component: application/controllers/Login.php
- Affected function: ajax_forgot_password (Forgot Password Endpoint)
Discovery Timeline
- 2026-05-31 - CVE-2026-10169 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-10169
Vulnerability Analysis
The vulnerability is classified as Weak Password Recovery Mechanism for Forgotten Password [CWE-640]. The ajax_forgot_password function in application/controllers/Login.php implements password reset logic that fails to enforce sufficient verification when processing the email parameter. An attacker reaches the endpoint over the network without authentication or user interaction. According to the public report, exploitation is rated as high complexity, meaning specific conditions must align for the attack to succeed. The exploit has been published, increasing the likelihood of opportunistic abuse against exposed instances.
Root Cause
The root cause is an insecure design in the password recovery workflow exposed via the AJAX forgot password endpoint. The function accepts an email argument and produces a recovery action that does not adequately bind the reset to a strong, unguessable, and time-limited token tied to the requesting user. This pattern matches CWE-640, where the recovery channel itself becomes the weakest link in account authentication.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker submits a crafted request to the Forgot Password endpoint, manipulating the email parameter to influence the recovery flow. Because the application exposes the function via AJAX in Login.php, the request can be issued directly with standard HTTP tooling. The vulnerability primarily impacts integrity, with no direct confidentiality or availability impact reflected in the published scoring.
No verified exploit code is published in the references. See the GitHub Issue Report and VulDB Vulnerability #367423 for technical context.
Detection Methods for CVE-2026-10169
Indicators of Compromise
- Unexpected POST requests to the ajax_forgot_password route in application/controllers/Login.php from unfamiliar source addresses.
- High volume of forgot-password requests targeting multiple user email values within short time windows.
- Successful account logins immediately following a password reset that the legitimate user did not initiate.
Detection Strategies
- Inspect web server and application logs for repeated invocations of the /login/ajax_forgot_password path with varying email parameters.
- Correlate password reset events with subsequent authentication attempts from new IP addresses or user agents.
- Alert on password recovery flows that complete without the expected email delivery and link click correlation.
Monitoring Recommendations
- Enable verbose logging on the Forgot Password endpoint, including source IP, user agent, and the requested email argument.
- Apply rate limiting and monitor for threshold breaches on password reset endpoints.
- Monitor for help desk reports of unsolicited password reset emails or unexpected account lockouts.
How to Mitigate CVE-2026-10169
Immediate Actions Required
- Restrict network exposure of the School Student Management System to trusted networks or place it behind a VPN until a fix is available.
- Add a web application firewall rule to rate limit requests to the ajax_forgot_password endpoint per source IP and per target email.
- Audit recent password reset activity and force re-verification for any accounts that received resets during the exposure window.
Patch Information
No official patch is available. The project does not use versioning, and the maintainers have not responded to the GitHub Issue Report. Administrators should track the upstream repository and the VulDB Vulnerability #367423 entry for updates. Until a fix is published, organizations should apply compensating controls described below.
Workarounds
- Disable the ajax_forgot_password route in application/controllers/Login.php and require administrator-driven password resets.
- Enforce out-of-band verification, such as a one-time code sent to a pre-registered phone number, before completing any password reset.
- Implement strong, single-use, time-limited recovery tokens bound to the requesting session if maintaining the in-product flow.
- Require multi-factor authentication on all accounts so a single recovery channel cannot fully compromise an account.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
