CVE-2026-82269 HIGH

CVE-2026-82269: Gophish Account Lockout and Forced Password Change Bypassable via API Key

Vendor Gophish

Product gophish

Weakness CWE-288

Published August 28, 2026

Last update August 28, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

Key dates

02Disclosure timeline

August 28, 2026 CVE published

August 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-82269 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/288.html AskarLabs — CWE-288 write-up Authentication Bypass Using an Alternate Path or Channel

Related vulnerabilities

04Related CVE

CVE-2026-24359 WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability CVE-2026-49062 WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability CVE-2026-59545 WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability CVE-2026-73396 WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability CVE-2026-42749 WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability