CVE-2026-94412: jshERP Authentication Bypass Vulnerability

CVE-2026-94412 Overview

CVE-2026-94412 is an authorization bypass vulnerability in jshERP through version 3.6, an open-source enterprise resource planning application. The flaw resides in the POST /user/resetPwd endpoint, which fails to verify that the authenticated caller owns the account being modified. Any authenticated user can submit a request containing an arbitrary target user ID and reset that account's password to a known default value. Successful exploitation grants unauthorized access to other accounts, including administrator accounts, enabling full application takeover. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
A low-privileged authenticated user can take over administrator accounts over the network by resetting arbitrary user passwords to a predictable default value.

Affected Products

jshERP through version 3.6
jshERP-boot backend component (UserController.resetPwd)
Deployments exposing the /user/resetPwd endpoint to authenticated users

Discovery Timeline

2026-09-21 - CVE-2026-94412 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94412

Vulnerability Analysis

The vulnerability is an authorization bypass in the password reset workflow of jshERP. The resetPwd handler in UserController.java accepts a user identifier from the request body and performs the password reset without confirming that the identifier matches the caller's session. Because the endpoint only enforces authentication and not ownership, any logged-in user, regardless of role, can target another account. The reset action replaces the target password with a fixed default value, allowing the attacker to authenticate as the target user immediately afterward.

Root Cause

The root cause is a missing authorization check between the authenticated principal and the target user ID supplied in the request. The controller trusts the client-supplied id parameter and does not compare it against the session user or evaluate role-based permissions. This pattern is a textbook Missing Authorization defect [CWE-862], where authentication is validated but authorization is not.

Attack Vector

An attacker first obtains any valid low-privileged jshERP account, either through self-registration, insider access, or reuse of leaked credentials. The attacker then issues an authenticated POST request to /user/resetPwd with the numeric id of a higher-privileged account, such as an administrator. The server resets the victim's password to the application default. The attacker logs in as the victim with the default password and inherits the victim's privileges, including administrative capabilities in the ERP application. See the VulnCheck jshERP Bypass Advisory, the GitHub PoC for Account Takeover, and the GitHub UserController Source Code for the vulnerable code path and reproduction steps.

Detection Methods for CVE-2026-94412

Indicators of Compromise

Requests to POST /user/resetPwd where the target id parameter does not match the authenticated user's ID.
Successful login events immediately following a resetPwd call, especially for administrator accounts.
Multiple resetPwd invocations from a single low-privileged session within a short time window.
Unexpected password change audit entries on privileged jshERP accounts.

Detection Strategies

Instrument the jshERP application or its reverse proxy to log the authenticated user ID alongside the target id submitted to /user/resetPwd, and alert on mismatches.
Correlate password reset events with subsequent authentication events from new source IPs or user agents.
Baseline normal resetPwd volume per user and flag deviations, particularly from non-administrative accounts.

Monitoring Recommendations

Forward jshERP application, web server, and authentication logs to a centralized analytics platform for correlation.
Monitor administrator account logins for anomalies such as new geolocations, off-hours access, or first-time-seen client fingerprints.
Track configuration and privilege changes performed shortly after any password reset event.

How to Mitigate CVE-2026-94412

Immediate Actions Required

Restrict network access to jshERP so that only trusted users can reach /user/resetPwd, ideally behind VPN or IP allowlisting.
Audit all jshERP accounts for unexpected password changes and force password resets on administrator accounts.
Review recent access logs for suspicious calls to /user/resetPwd and correlate with subsequent logins.
Rotate credentials and API tokens tied to any account whose password may have been reset.

Patch Information

No vendor-supplied patch is referenced in the CVE record at the time of publication. Monitor the GitHub jshERP Repository and the VulnCheck jshERP Bypass Advisory for a fixed release. Until an official fix is available, operators should apply the workarounds below and consider forking the code to add an authorization check in UserController.resetPwd that verifies the requesting session owns the target id or holds an explicit administrative role.

Workarounds

Add a reverse-proxy rule that blocks POST /user/resetPwd requests where the body id does not match the session user, or restrict the endpoint to administrator sessions only.
Disable self-registration in jshERP to reduce the pool of attackers who can obtain the low-privileged session required for exploitation.
Change the application default password used by the reset routine to a strong random value per deployment, invalidating the known-default assumption used by public PoCs.
Enforce multi-factor authentication in front of jshERP through an upstream identity provider so that a reset password alone is insufficient to authenticate.

bash

# Example NGINX rule to block resetPwd requests from non-admin sessions
location = /user/resetPwd {
    if ($request_method = POST) {
        # Require an admin role cookie/header enforced by an upstream auth service
        if ($http_x_jsh_role != "admin") {
            return 403;
        }
    }
    proxy_pass http://jsherp_backend;
}