CVE-2026-90522: Tourism Management System Auth Bypass

CVE-2026-90522 Overview

CVE-2026-90522 is a weak password recovery vulnerability in the jaychouchannel Tourism-Management-System, a Java-based web application. The flaw resides in the resetPass function within UsersController.java, part of the Password Recovery component. The endpoint accepts a username parameter and resets the associated password without validating the requester's ownership of the account or requiring proof of the existing credential. An unauthenticated remote attacker can invoke the endpoint to reset arbitrary user passwords. The exploit has been publicly disclosed. Because the project uses continuous delivery with rolling releases, no fixed version number is published; instead, commit 9cb6215ac871f99a90cde763cf003e95ff282283 contains the patch. The weakness is classified under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password].

Critical Impact

An unauthenticated remote attacker can reset any user's password by submitting only a username to the vulnerable endpoint, enabling account takeover across the application.

Affected Products

• jaychouchannel Tourism-Management-System (rolling releases up to commit d984d172dceca907f8b447efbdb06dc233f7938d)
• Component: Password Recovery (resetPass function in UsersController.java)
• Component: Password Recovery (resetPass function in DaoyouController.java)

Discovery Timeline

• 2026-09-13 - CVE-2026-90522 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90522

Vulnerability Analysis

The Tourism-Management-System exposes a /resetPass endpoint that changes an account's password based on a username parameter alone. The controller performs no verification that the caller owns the account or possesses the current password. Any remote client that can reach the application can therefore reset any known user's password and log in as that user. The issue affects both UsersController.java and DaoyouController.java, indicating the flawed pattern was duplicated across controllers serving different user roles (including tour guide accounts). Because the application is distributed as a rolling release from a public Git repository, downstream deployments must apply the source-level fix directly rather than upgrade to a fixed release number.

Root Cause

The root cause is a missing authorization and identity-proof check in the password reset workflow, categorized as [CWE-640]. The vulnerable handler treats the username request parameter as sufficient authority to overwrite that user's password. There is no verification of the previous password, no out-of-band recovery token, no email-based confirmation link, and no session ownership check tying the caller to the target account.

Attack Vector

Exploitation is performed over the network with no authentication and no user interaction. An attacker sends an HTTP request to the /resetPass endpoint supplying the target username. The server accepts the request and updates the stored password, after which the attacker can authenticate as the victim. Enumerable or guessable usernames (such as admin) allow trivial takeover of privileged accounts.

// Security patch for resetPass in UsersController.java and DaoyouController.java
// Merge pull request #15: fix/unauthorized-password-reset

 * 密码重置
 */
@RequestMapping(value = "/resetPass")
-public R resetPass(String username, HttpServletRequest request){
+public R resetPass(String username, String oldPassword, String newPassword, HttpServletRequest request){
     Long userId = (Long) request.getSession().getAttribute("userId");
     if (userId == null) {
         return R.error(401, "请先登录");
     }

// Source: https://github.com/jaychouchannel/Tourism-Management-System/commit/9cb6215ac871f99a90cde763cf003e95ff282283
// The patch requires the caller to be authenticated (session userId present)
// and to supply the current password (oldPassword) before setting newPassword.

Detection Methods for CVE-2026-90522

Indicators of Compromise

• HTTP requests to /resetPass originating from unauthenticated sessions or unusual source IP addresses.
• Sudden password change events for multiple accounts, especially administrative or high-value users, within a short window.
• Successful logins immediately following a /resetPass invocation from the same source address.
• Application log entries showing resetPass calls that lack an associated userId session attribute.

Detection Strategies

• Instrument the resetPass endpoints in UsersController.java and DaoyouController.java to log every invocation with source IP, session identifier, target username, and outcome.
• Alert on any /resetPass request that succeeds without a valid authenticated session, which indicates exploitation of the unpatched code path.
• Correlate password reset events with subsequent authentication events to surface end-to-end account takeover chains.

Monitoring Recommendations

• Ingest web server and application logs into a centralized analytics platform and build a rule for high-frequency /resetPass calls per source IP.
• Track deployed application build hashes and flag any environment still running commits at or before d984d172dceca907f8b447efbdb06dc233f7938d.
• Monitor the upstream GitHub repository and Issue #13 for additional advisories.

How to Mitigate CVE-2026-90522

Immediate Actions Required

• Apply the upstream fix in commit 9cb6215ac871f99a90cde763cf003e95ff282283 and redeploy the application.
• Force a password reset for all user accounts, prioritizing administrative and tour guide accounts, to invalidate any credentials changed by an attacker.
• Invalidate all active sessions after redeployment to evict any adversary already authenticated using a reset password.
• Review application access logs for prior /resetPass activity that predates the patch.

Patch Information

The vendor patch is identified as commit 9cb6215ac871f99a90cde763cf003e95ff282283 in the jaychouchannel/Tourism-Management-System repository. The change updates resetPass in both UsersController.java and DaoyouController.java to require an authenticated session (validated via request.getSession().getAttribute("userId")) and to accept oldPassword and newPassword parameters so the current password can be verified before the new password is stored. Additional context is available in the VulDB entry for CVE-2026-90522.

Workarounds

• Restrict network access to the /resetPass endpoint via a reverse proxy or web application firewall rule until the patch is deployed.
• Require authentication upstream (for example, at an ingress or gateway layer) so anonymous callers cannot reach the vulnerable handler.
• Temporarily disable the /resetPass route and provide password resets through an out-of-band administrative process.

# Example nginx rule to block unauthenticated access to /resetPass
# until the upstream patch (commit 9cb6215) is deployed.
location /resetPass {
    # Allow only internal admin subnet
    allow 10.0.0.0/24;
    deny  all;
    proxy_pass http://tourism_backend;
}