EUVD-2026-101570

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110770

Databasus versions 3.7.0 through 3.61.0 are vulnerable to an authentication bypass vulnerability. Unauthenticated attackers can exploit the POST /api/v1/users/reset-password endpoint to request a six-digit password reset code for a known email address. Due to a lack of rate limiting, lockout mech...