CWE-620Unverified Password Change

Abstraction: Base · CVEs in our corpus: 93

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.

Last updated: 21 August 2026 14:15 UTC

OWASP Top 10 for Web (2025)

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-20419`	10.0	10.0	0.8064	2024-07-17
`CVE-2024-48887`	8.4	9.8	0.1483	2025-04-08
`CVE-2025-4322`	8.4	9.8	0.1565	2025-05-20
`CVE-2024-33699`	7.9	9.9	0.1064	2024-10-30
`CVE-2024-12824`	7.7	9.8	0.0230	2025-03-01
`CVE-2024-13375`	7.6	9.8	0.0144	2025-01-18
`CVE-2023-2297`	7.5	9.8	0.0099	2023-04-27
`CVE-2023-2449`	7.5	9.8	0.0090	2023-11-22
`CVE-2025-10159`	7.5	9.8	0.0088	2025-09-09
`CVE-2023-3069`	7.4	9.8	0.0060	2023-06-02
`CVE-2025-2253`	7.4	9.8	0.0080	2025-05-09
`CVE-2025-63362`	7.4	9.8	0.0059	2025-12-04
`CVE-2020-7378`	7.3	9.1	0.0262	2020-11-24
`CVE-2024-37998`	7.3	9.8	0.0045	2024-07-22
`CVE-2024-26520`	7.3	9.8	0.0051	2024-07-26
`CVE-2024-12860`	7.3	9.8	0.0048	2025-02-18
`CVE-2025-3603`	7.3	9.8	0.0053	2025-04-24
`CVE-2025-4558`	7.3	9.8	0.0051	2025-05-12
`CVE-2025-4606`	7.3	9.8	0.0056	2025-07-09
`CVE-2025-9286`	7.3	9.8	0.0044	2025-10-03
`CVE-2025-70082`	7.3	9.8	0.0039	2026-03-11
`CVE-2026-15964`	7.3	9.8	0.0049	2026-08-01
`CVE-2024-12827`	7.2	9.8	0.0035	2025-06-27
`CVE-2025-67041`	7.2	9.8	0.0033	2026-03-11
`CVE-2026-12692`	7.2	9.8	0.0035	2026-07-17