CVE-2026-53904: MCO Account Denial of Service Vulnerability

CVE-2026-53904 Overview

CVE-2026-53904 is an account denial of service vulnerability in MyComplianceOffice (MCO). The application implements password reset functionality without rate limiting or proper credential invalidation controls. An attacker who knows a victim's email address and can answer their security question can repeatedly trigger password resets. Each reset invalidates the previously set password and any previously issued temporary passwords. This locks the legitimate user out of their account. The vulnerability has been confirmed in MCO version 25.3.3.1, though other versions may also be affected because vendor contact attempts were unsuccessful. The finite number of security question attempts partially limits exploitability. The weakness is categorized as [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Critical Impact
An attacker with knowledge of a victim's email and security question answer can permanently lock the victim out of their MCO account by continuously invalidating credentials.

Affected Products

MyComplianceOffice (MCO) version 25.3.3.1
Other MCO versions potentially affected (unconfirmed due to lack of vendor response)
MCO password reset workflow component

Discovery Timeline

2026-07-01 - CVE-2026-53904 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53904

Vulnerability Analysis

The vulnerability resides in the password reset workflow of MyComplianceOffice (MCO). The reset process accepts an email address and a correct security question answer as sufficient proof to trigger a new temporary password. The reset endpoint does not enforce any throttling, rate limit, or lockout after successive requests. Each successful reset invalidates both the current active password and any previously issued temporary passwords. An attacker who repeatedly invokes the reset workflow prevents the legitimate account owner from ever completing authentication with a valid credential.

The issue is a business logic and authentication control flaw rather than a memory corruption or injection vulnerability. It falls under [CWE-307] Improper Restriction of Excessive Authentication Attempts. The impact is limited to availability of the targeted account. Confidentiality and integrity are not directly affected because the attacker does not gain access to the account. The security question mechanism has a bounded number of attempts, which reduces the population of accounts an attacker can realistically target.

Root Cause

The root cause is twofold. First, the password reset endpoint lacks rate limiting or abuse detection. Second, the credential invalidation logic aggressively voids all previously issued credentials, including temporary ones the legitimate user may be attempting to use. These design choices, combined with static knowledge-based authentication factors, produce a persistent account lockout condition.

Attack Vector

The attack is executed remotely over the network without authentication or user interaction. The attacker must know the victim's registered email address and correctly answer the account's security question. Once these prerequisites are met, the attacker submits repeated password reset requests through the public MCO reset workflow. Each request invalidates the credential state the legitimate user relies on. The attacker does not need to access the victim's email inbox because the goal is disruption, not account takeover. See the CERT Poland advisory for additional workflow details.

Detection Methods for CVE-2026-53904

Indicators of Compromise

Repeated password reset requests targeting the same account email within short time windows
Multiple temporary password issuance events for a single user without corresponding successful logins
User help desk tickets reporting inability to log in despite receiving reset emails
Security question submission attempts originating from unfamiliar IP addresses or geolocations

Detection Strategies

Instrument application logs to record every password reset request with source IP, user agent, and timestamp
Alert when a single account receives more than a defined threshold of reset requests within a rolling window
Correlate reset events with failed and successful authentication attempts to identify persistent lockout patterns
Monitor for security question answer submissions that succeed from IP addresses previously unseen for that account

Monitoring Recommendations

Forward MCO authentication and password reset logs to a centralized SIEM for correlation and retention
Baseline normal password reset frequency per user and alert on statistical deviations
Track affected user reports through the service desk and correlate with authentication telemetry
Review network access logs for automated or scripted access patterns against the reset endpoint

How to Mitigate CVE-2026-53904

Immediate Actions Required

Contact MyComplianceOffice support to confirm whether a patched version is available beyond 25.3.3.1
Restrict access to the MCO application to trusted networks or via VPN where feasible
Educate users to protect their registered email addresses and security question answers from disclosure
Enable available multi-factor authentication options on MCO accounts to reduce reliance on knowledge-based recovery

Patch Information

No vendor patch has been published in the referenced advisories at the time of NVD publication. CERT Poland reported unsuccessful vendor contact attempts. Organizations should track updates on the MyComplianceOffice site and the CERT Poland advisory for remediation guidance.

Workarounds

Implement upstream rate limiting on the MCO reset endpoint using a reverse proxy or web application firewall
Configure account-based throttling rules that block repeated reset attempts against the same email within a defined window
Require additional out-of-band verification such as a phone call or ticket-based identity check before honoring resets for high-value accounts
Rotate security question answers periodically and treat them as secrets rather than memorable facts

bash

# Example WAF rate limit rule (nginx) to throttle password reset abuse
limit_req_zone $binary_remote_addr zone=mco_reset:10m rate=5r/m;

server {
    location /password-reset {
        limit_req zone=mco_reset burst=3 nodelay;
        proxy_pass https://mco.internal.example.com;
    }
}