A vulnerability marked as critical has been reported in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password.
This vulnerability appears as CVE-2026-3186. The attack may be initiated remotely. In addition, an exploit is available.
It is suggested to upgrade the affected component.
The project was informed beforehand and acted very professional: “We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets.”
