CVE-2025-56676

TitanSystems Zender v3.9.7 has a flaw in its password reset feature where a reset token meant for one user can be used to log into any other user's account. An attacker can take over accounts by exploiting this broken validation, gaining unauthorized access to sensitive information.

The password reset functionality fails to properly validate the linkage between reset tokens and user accounts (CWE-1259: Improper Validation of Specified Quantity in Input). An attacker can intercept or obtain a reset token issued to one user and apply it to another user's account during login, bypassing authentication and achieving account takeover. This enables unauthorized access and privilege escalation without requiring the target user's credentials.