Databasus: Authentication bypass via brute-force of password reset codes

Summary

Databasus 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes via the reset-password API endpoint. The reset codes are not protected by rate limiting, lockout or invalidation. A successful attacker can take over user accounts, including administrator accounts, and access backup configuration and connection settings.

Affected

• Databasus 3.7.0 through 3.61.0
• Versions after 3.61.0: Unknown.

Fixed in

Unknown. No fixed version has been published by the vendor at the time of writing.

Workaround

• Do not expose the Databasus web interface or API to the internet; use a VPN or a reverse proxy with an IP allowlist.
• At the reverse proxy, apply rate limiting or block /api/v1/users/reset-password for untrusted sources, and verify that the rule covers the API path.
• Review logs for high volumes of POST requests to the reset endpoint, unexpected password resets and logins from unknown sources.

Exploitation

• Publicly available write-up exists (HackMD); its content has not been verified.
• VulDB reports no available exploit.
• No evidence of exploitation in the wild found; not listed in CISA KEV.
• EPSS score reported as 0.00495 (low).

Our recommendation

• Check whether any Databasus instance runs version 3.7.0 through 3.61.0 and whether it is reachable from the internet.
• Restrict network access to the instance now (VPN or IP allowlist) until a vendor fix is confirmed.
• Ask the vendor for a patch date and confirmation of whether later versions are affected; update as soon as a fixed release is available.
• After patching, reset administrator passwords, review the user list and invalidate active sessions.
• Monitor logs for reset-password request floods and unexpected logins.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory: Databasus account takeover via password reset brute-force www.vulncheck.com
• Databasus GitHub repository github.com
• Databasus GitHub security page github.com
• Root cause reference: user_services.go at commit 9ee25ed github.com
• HackMD write-up on password reset code brute-force hackmd.io
• VulDB entry 420333 vuldb.com
• Vulners CVE record CVE-2026-110770 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:24.