Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-108337 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Hitachivantara (inferred from references). Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-12 (Identity Proofing) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-101707
Vulnerability Data
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The…
more
API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Identity proofing at appropriate assurance levels ensures forgotten-password recovery cannot succeed without strong verification of the user.
Authenticator management requires secure distribution, reset, and verification procedures that directly address weak password recovery flows.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Secure SDLC reduces implementation flaws but is not specific to password-recovery design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
A.8.29's combined programme (code review, static analysis, vulnerability scanning, penetration testing) reaches CWE-640 from both SOURCE and RUNTIME angles: pentesters routinely exercise password recovery flows for brute-force, token reuse, and information disclosure (the exact failure modes in the 2024-2025 CVE examples), and code review catches implementation flaws like missing throttling or returning the original password; the remainder is design-level weaknesses (e.g., security questions that are too common or guessable from social media) where the code looks reasonable and the weakness only surfaces under a review of the recovery design itself.
Secure-coding standards can prevent weak recovery implementations, yet the control is wider in scope.