CVE-2026-28213 - Vulnerability Analysis

Overview

EverShop < 2.1.1 contains an information disclosure vulnerability caused by the password reset token being returned in the API response of the Forgot Password functionality, letting attackers take over accounts, exploit requires specifying target email.

Severity & Score

Impact

Attackers can take over user accounts by obtaining password reset tokens.

Mitigation

Upgrade to version 2.1.1 or later.

References

• https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1
• https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🔴 CVE-2026-28213 - Critical (9.8) EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attac... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28213/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner