SEC.co
Emergency

By weakness (CWE)

CWE-324: related vulnerabilities

CVEs classified under CWE-324. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-52809MEDIUM 6.8

    Gogs, a self-hosted Git service, contains a password-reset token vulnerability affecting versions before 0.14.3. When administrators configure a shorter password-reset window (such as 10 minutes) for security or compliance purposes, the system ignores that setting and instead issues tokens valid for the much longer account-activation lifetime. Users receive password-reset emails that falsely claim tokens expire in the configured shorter timeframe, but the tokens remain valid far longer than advertised. This discrepancy between stated and actual token lifetime significantly extends the window in which a stolen reset token can be exploited to compromise an account.