CVE Catalog
CVE-2026-48902
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.25%
17th percentile - higher than 17% of all known CVEs
Summary
The password and username reset features created plain HTTP links for HTTPS connections if the "Force SSL" flag wasn't explicitly set.
Risk Assessment
An attacker can intercept the reset link in plaintext, leading to account takeover.
Recommendation
Always enable the "Force SSL" flag or enforce HTTPS in the application configuration.
Original NVD description (English source)
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.