CVE-2026-10169: Weak Password Recovery in OUSL-GROUP-BrinaryBrains School Management System

Technical summary

CVE-2026-10169 is a weak password recovery vulnerability (CWE-640) in the ajax_forgot_password function of application/controllers/Login.php within OUSL-GROUP-BrinaryBrains School Student Management System. The flaw stems from insufficient validation or cryptographic safeguards on the email parameter, enabling attackers to bypass or manipulate password recovery mechanisms. The affected product does not use semantic versioning; the vulnerability has been identified in commits up to hash 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. The CVSS v3.1 score of 3.7 reflects low integrity impact with high attack complexity, though public exploit availability increases practical risk.

Business impact

Student information systems managing enrollment, grades, and academic records are potential targets. Compromised educator or administrator accounts could lead to unauthorized access to sensitive student data (FERPA-protected in the US), grade tampering, or disruption of academic operations. The impact is primarily integrity-focused rather than availability-driven. Institutions relying on this system should assess data sensitivity and regulatory obligations governing educational records.

Affected systems

OUSL-GROUP-BrinaryBrains School Student Management System is affected up to the commit hash 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. No version numbers are officially released for this product. The vendor has not yet responded to early disclosure notifications. Organizations should verify their deployment status directly with the project or by inspecting their installed commit hash.

Exploitability

The vulnerability is remotely exploitable without authentication. However, successful exploitation requires high attack complexity—meaning an attacker must satisfy non-trivial preconditions such as crafting specific email payloads or exploiting timing windows in the password recovery workflow. Public exploit code now exists, lowering the barrier for less sophisticated attackers. Nevertheless, widespread mass exploitation is unlikely due to attack complexity constraints.

Remediation

Engage with the OUSL-GROUP-BrinaryBrains project to obtain a patched version or commit hash that remediates the weak password recovery logic. Remediation should include: robust input validation on email parameters, implementation of time-limited and cryptographically secure password reset tokens, rate limiting on password recovery requests, and logging of recovery attempts. Until a fix is available, consider implementing Web Application Firewall (WAF) rules to restrict suspicious patterns in forgot-password requests.

Patch guidance

The vendor has not yet released an official patch. Monitor the project repository and advisory channels for updates. When available, patches should address email parameter validation and token generation in the password recovery endpoint. Test patches in a non-production environment before deployment. Given the educational nature of the system, coordinate patching with academic calendars to minimize disruption. Contact the vendor directly to understand their remediation timeline and interim mitigations.

Detection guidance

Monitor access logs for unusual patterns in the /ajax_forgot_password endpoint, including repeated requests with varying email parameters, requests from anomalous geographic locations, or requests followed by suspicious login activity. Implement intrusion detection rules targeting CWE-640 weak recovery patterns. Log all password recovery requests with timestamps, source IPs, and email addresses targeted. Alert on high request rates to the forgot-password endpoint or on recovery tokens used outside normal time windows.

Why prioritize this

Despite the LOW CVSS score, this vulnerability warrants attention because it affects a school management system handling sensitive student and staff data. Educational institutions face regulatory compliance obligations (FERPA, state privacy laws) regarding record security. Public exploit availability elevates practical risk. However, the high attack complexity means this is not an emergency—prioritize after patching higher-severity vulnerabilities, but address within standard patching cycles to maintain defense-in-depth posture.

Risk score, explained

The CVSS v3.1 score of 3.7 (LOW) reflects: remote network accessibility (AV:N), high attack complexity (AC:H) requiring specific conditions, no privilege or user interaction required (PR:N/UI:N), limited scope (S:U), negligible confidentiality impact (C:N), low integrity impact (I:L) via potential account takeover, and no availability impact (A:N). The score appropriately captures the technical difficulty of exploitation. However, context matters: educational data sensitivity and public exploit availability suggest organizations should not delay remediation solely based on CVSS alone.

Frequently asked questions