Weak Password Change Mechanism in athou/commafeed


Reported on

Jul 5th 2022


When setting a new user password, commafeeddoes not require knowledge of the original password or using another form of authentication.

Proof of Concept

1. Log in as a regular user 
2. Go to the profile settings link
3. Select Set Password
4. Enter any 6-character password string (this form is not constrained by the common passwords blocked in initial user creation).


If an attacker can gain access to an active user session (i.e. accessing terminal when user stands up), it would not be necessary to know the victim's current password in order to fully compromise the account.

We are processing your report and will contact the athou/commafeed team within 24 hours. a year ago
Jérémie Panzer modified the Severity from Critical to Low a year ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Jérémie Panzer validated this vulnerability a year ago
saharshtapi has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Jérémie Panzer marked this as fixed in 2.6.0 with commit 899a8d a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation