Password Reset Broken Everywhere: What This Week's CVEs Tell Us About Trust
Three critical vulnerabilities landed in the NVD this week. All three carry a CVSS score of 9.8. All three exploit the same category of failure: password reset logic that does not do what it is supposed to do.
That is not a coincidence. That is a pattern. And patterns tell you where to look.
The Signal in This Week’s CVEs
Let’s take these in order of what they tell us, rather than order of publication.
CVE-2026-18550 affects the Nokri Job Board WordPress theme, versions up to and including 1.6.1.6. The vulnerability is in the nokri_reset_password() function. The reset token supplied by the attacker does not need to match a valid token in the database. It just needs to match whatever value is stored in the user’s meta field, which can be empty or unset. An empty attacker-supplied token matches an empty stored token. Authentication is bypassed. Admin account taken. Game over.
This is not a sophisticated attack. It requires no credentials, no prior access, no social engineering. Any WordPress site running this theme is a one-request compromise.
CVE-2026-84699 is arguably worse, because of what product it affects. Team Password Manager, before version 14.184.308, fails to enforce authentication on the local account password reset flow. An unauthenticated attacker can reset any local account password and then authenticate as that user. If your business uses Team Password Manager and has not updated to 14.184.308, every credential stored in it is potentially accessible to anyone who can reach the reset endpoint.
A password manager with a broken authentication flow is not a password manager. It is a credential database with an unlocked door.
CVE-2026-84480 completes the set. WWBN AVideo fails to validate token expiration in its password recovery handler. An attacker who obtained a reset token at any point in the past, through any means, can use it today. The token never expires. There is no patch available at time of writing.
Three products. Three different implementations. One shared failure: the assumption that a reset token, once issued, is trustworthy.
The Exchange Problem Has Not Gone Away
Separate from the CVE cluster, the Shadowserver Foundation published research this week confirming that approximately 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911. That vulnerability is an authentication bypass allowing unauthenticated attackers to access mailboxes across the entire server. Read emails. Send emails. Download attachments. The Dutch NCSC upgraded its risk classification to High/High following the appearance of proof-of-concept exploit code.
For UK small businesses, this is worth translating into plain terms. If your business runs Microsoft Exchange on-premises and your IT provider has not confirmed the patch is applied, an attacker can read your email. All of it. Without knowing your password. Without your knowledge. Without leaving a trace you would easily find.
Self-hosted Exchange at a small business is, in most cases, an infrastructure choice made ten years ago that has not been revisited. If that describes you, now is the time to revisit it.
What the Pattern Actually Means
Account recovery is consistently the weakest point in authentication systems. Not because the cryptography is hard, but because the logic around it is treated as an edge case during development. What happens if the token field is empty? What happens if the token never expires? What happens if we check the token client-side rather than server-side?
Attackers know this. They probe reset endpoints systematically because the success rate is high and the detection rate is low. A reset request looks like a legitimate user action. It does not trigger the same alarms as a brute-force login attempt.
The implication for small businesses is specific. If you are running any web-facing application, including your website’s CMS, any customer portal, any business tool with a browser interface, the question to ask your IT provider is not “is it patched” in the abstract. The question is: “When did you last verify that the password reset flow on this system actually requires a valid, unexpired token, and rejects anything else?”
That is a different question. It requires an answer.
How to Turn This Into a Competitive Advantage
Supply chain risk is a live procurement question for UK businesses of all sizes. If you are a supplier to larger organisations, those organisations are increasingly asking about your security posture before awarding contracts.
Being able to demonstrate that you actively monitor for critical vulnerabilities, patch within defined timeframes, and have audited your authentication flows is not just good security practice. It is a commercial differentiator. It reduces the friction in procurement. It removes you from the risk column on a client’s vendor assessment.
The businesses that will struggle in the next two years are not those who get breached. It is those who cannot demonstrate they were paying attention. Document your patch verification. Document your vendor checks. It costs almost nothing and is worth considerably more than that.
How to Sell This to Your Board
Three arguments that land with non-technical decision-makers.
First: the Shadowserver Foundation has publicly identified 22,000 unpatched Exchange servers. Researchers can find them. Attackers can find them too. If your server is on that list, you are not a difficult target. You are a confirmed one.
Second: a broken password reset is not a theoretical risk. It is an unauthenticated attacker resetting your admin credentials without your knowledge. The data protection implications under UK GDPR are immediate. A breach of this type is reportable to the ICO within 72 hours. The question for the board is whether they want to be in that conversation.
Third: patching and configuration audits are not expensive. The cost of not doing them is forensics, breach notification, regulatory correspondence, and reputational damage. The comparison is not between spending money and not spending money. It is between spending a small amount now and a large amount later.
What This Means for Your Business
1. Check your WordPress plugins and themes this week. If you are running the Nokri Job Board theme, update immediately or remove it. More broadly, run an audit of every theme and plugin on your WordPress installation and remove anything that is not actively maintained and up to date.
2. Verify your Team Password Manager version. If you are running any version below 14.184.308, update today. Before you update, change the master credentials and rotate any passwords stored in the system. Assume they may have been accessed.
3. Audit WWBN AVideo installations. If your business or a supplier runs AVideo, there is currently no patch for CVE-2026-84480. The mitigating action is to restrict access to the reset endpoint at the network level and monitor for any reset activity that cannot be attributed to a known user request.
4. Confirm Exchange patch status. If your business runs on-premises Exchange, contact your IT provider today and ask for written confirmation that CVE-2026-62911 is patched. If they cannot confirm it by end of day, treat the server as potentially compromised until they can.
5. Ask a harder question about account recovery across your estate. For every system your business uses that has a password reset function, ask your IT provider when they last verified that function works correctly and securely. Not that it works. That it works securely. There is a difference, and this week’s CVEs illustrate exactly what that difference costs.
Before you go: follow the show wherever you listen, leave a rating or review, drop a comment with your thoughts, and share this episode with someone who would find it useful. If you have a question about anything covered today, put it in the comments and we will pick it up on the next brief.