Integrics Enswitch Critical Flaw Lets Attackers Reset Passwords Without Credentials via CVE-2026-107640
A critical flaw in Integrics Enswitch permits attackers to reset user passwords without credentials, enabling full account takeover through username enumeration.
Key points
- CVE-2026-107640 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- The vulnerability affects Integrics Enswitch versions 3.13 through 4.4.
- Attackers can bypass authentication by omitting a specific parameter in password update requests.
Integrics Enswitch contains a critical authentication bypass vulnerability that allows unauthenticated actors to reset user passwords. The flaw, tracked as CVE-2026-107640, resides in the application’s API endpoint for password updates and enables attackers to take over accounts, including administrative privileges, without possessing valid credentials.
Root cause
The vulnerability stems from improper handling of the password update mechanism within the `/api/json/user/password/update/` endpoint. According to the National Vulnerability Database record, the server defaults to an empty value for the `reset_key` parameter if it is omitted from the request. This design flaw means that any account with no pending password reset will have an empty `reset_key` that matches this default. Consequently, the authentication check fails to validate the legitimacy of the request, allowing the password change to proceed without verification.
Attack path
An attacker begins by enumerating valid usernames within the target Integrics Enswitch installation. Once a valid username is identified, the attacker sends a request to the vulnerable API endpoint to update the password. By deliberately omitting the `reset` parameter, the attacker exploits the server’s defaulting behaviour. Because the targeted account has no pending reset, its `reset_key` is empty, matching the server’s expected default. This allows the attacker to successfully change the password and gain access to the account. The process can be repeated to compromise administrator accounts, granting full control over the system.
Affected versions
The vulnerability affects the following versions of Integrics Enswitch:
- Version 3.13
- Version 4.4
- All versions between 3.13 and 4.4 inclusive
Mitigation
No patch or fix has been confirmed yet for CVE-2026-107640. Security operations teams should consider the following immediate steps:
- Restrict external access to the `/api/json/user/password/update/` endpoint using firewall rules or web application firewalls.
- Monitor logs for unusual password reset activity or requests missing the `reset` parameter.
- Enforce strict username policies to make enumeration more difficult, though this does not mitigate the core vulnerability.
- Contact Integrics for updates regarding a security release.
Background: National Vulnerability Database
The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.
Read the full guide: National Vulnerability Database: Small Business Action Plan
What to do and how to stay safe: Integrics
- Advisory scores measure exploitability, not the impact on your specific business logic or data.
- A vulnerability may be theoretically present but functionally impossible to reach due to network segmentation.
- Vendor patches often introduce new regressions that require testing before deployment in production.
Security advisories are incomplete risk assessments that require your specific context to become actionable. Map every advisory to your actual assets and attack paths before prioritising remediation efforts.
Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107640?
The National Vulnerability Database rates CVE-2026-107640 as CVSS 9.3 Critical.
Which versions of Integrics Enswitch are vulnerable?
Integrics Enswitch versions 3.13 through 4.4 are affected by this authentication bypass vulnerability.
Can an attacker gain administrative access through this flaw?
Yes, attackers can take over administrator accounts by enumerating valid usernames and exploiting the password update endpoint.
