CVE-2026-93340: Gladys Assistant Auth Bypass Vulnerability

CVE-2026-93340 Overview

CVE-2026-93340 is a password reset link poisoning vulnerability in Gladys Assistant versions before 5.1.0. The forgot_password endpoint accepts a client-supplied origin parameter and uses it to construct the password reset link without server-side validation. Unauthenticated remote attackers can submit a crafted request specifying an attacker-controlled origin. The victim then receives an email containing a poisoned reset link that leaks the session token to the attacker upon click. Successful exploitation enables full account takeover, including administrator accounts. The weakness is classified as CWE-640: Weak Password Recovery Mechanism for Forgotten Password.

Critical Impact
Unauthenticated attackers can hijack any Gladys Assistant account, including administrators, by tricking users into clicking poisoned password reset links that disclose valid session tokens.

Affected Products

Gladys Assistant versions prior to 5.1.0
Self-hosted Gladys Assistant home automation deployments exposed to attacker-reachable networks
Gladys Assistant instances using the built-in forgot_password workflow

Discovery Timeline

2026-09-21 - CVE-2026-93340 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93340

Vulnerability Analysis

Gladys Assistant is an open-source home automation platform. The vulnerable password reset workflow accepts an origin value from the client request body and embeds it directly into the password reset URL sent to the user. Because the server does not validate this value against an allowlist of trusted hosts, an attacker can force the application to generate a reset link that points to a domain they control.

The reset link contains a valid, server-issued password reset token bound to the victim account. When the victim clicks the poisoned link, the browser transmits the token to the attacker's host as part of the URL path or query string. The attacker then replays the token against the legitimate Gladys Assistant instance to complete the password reset and take over the account.

Administrator accounts are within scope, which allows the attacker to reconfigure integrations, control connected smart-home devices, and pivot within the local network the Gladys server has access to.

Root Cause

The root cause is missing server-side validation of the origin parameter used to build the password reset URL. The application trusts client input to determine where the reset link points, a canonical instance of [CWE-640]. A secure implementation must derive the reset link host from a fixed server configuration or from a strict allowlist of approved origins.

Attack Vector

Exploitation requires network access to the Gladys Assistant forgot_password endpoint and user interaction from the victim (clicking the poisoned link). The attacker sends a POST request to the forgot password endpoint containing the victim's email address and an attacker-controlled origin value. The server generates a reset token, embeds it in a URL rooted at the attacker's origin, and delivers it to the victim's email inbox. Once the victim clicks the link, the token is disclosed to the attacker, who submits it to the real Gladys Assistant host to reset the account password.

See the VulnCheck Advisory on Gladys for the full technical writeup and request structure.

Detection Methods for CVE-2026-93340

Indicators of Compromise

Requests to the forgot_password endpoint containing an origin field whose host does not match the deployment's canonical URL.
Outbound email logs referencing password reset URLs pointing to unexpected domains.
Successful password change events shortly after a forgot_password request initiated from an unfamiliar IP address.
Administrator account logins from new geographies or user agents following recent reset activity.

Detection Strategies

Inspect application and reverse-proxy logs for POST requests to the password reset endpoint and record the submitted origin value for review.
Alert on any deviation between the Host header of the Gladys server and the origin used to build reset links.
Correlate password reset requests with subsequent authentication events to identify accounts reset from unrelated source IPs.

Monitoring Recommendations

Forward Gladys Assistant application logs and mail relay logs to a centralized logging platform for retention and correlation.
Enable alerting on administrator account password changes and privileged configuration modifications.
Monitor for outbound DNS or HTTP traffic to newly observed domains referenced in outgoing reset emails.

How to Mitigate CVE-2026-93340

Immediate Actions Required

Upgrade Gladys Assistant to version 5.1.0 or later, which addresses the origin validation flaw.
Force a password reset for all existing accounts, prioritizing administrator accounts, once patched.
Invalidate any outstanding password reset tokens issued by the vulnerable version.
Restrict network exposure of the Gladys Assistant management interface to trusted networks or a VPN.

Patch Information

The vendor released the fix in Gladys Assistant 5.1.0. Refer to the GitHub Release v5.1.0 notes and the Gladys Blog Integration Update for release details and upgrade guidance.

Workarounds

Place the Gladys Assistant instance behind a reverse proxy that strips or overrides the origin request parameter before it reaches the application.
Block internet-facing access to the forgot_password endpoint until the upgrade is applied.
Educate users to verify that password reset links point to the legitimate Gladys Assistant host before clicking.

bash

# Configuration example: nginx reverse proxy rule to block untrusted origin values
location /api/v1/forgot-password {
    if ($request_method = POST) {
        # Reject requests whose body-supplied origin is not the trusted host
        set $trusted_origin "https://gladys.example.com";
        # Enforce upstream validation and drop suspicious calls
        limit_except POST { deny all; }
    }
    proxy_pass http://gladys_backend;
}