Password Reset Code Accessible in User Listing API
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
CVE-2026-108337
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108337
Remot Ops Agent
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Hitachi Vantara",
"modules": [
"Web Interface"
],
"product": "Remot Ops Agent",
"versions": [
{
"status": "unaffected",
"version": "2.1"
},
{
"status": "affected",
"version": "1.6.0",
"versionType": "semver",
"lessThanOrEqual": "2.0"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-108337
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34417 · Revision 1
- Added to Heist Feed
- Publisher date