AKIN MyRezzta: Brute force of password reset codes leading to account takeover
Summary
MyRezzta versions from 2.06.03 before 2.07.01 contain a weak password recovery mechanism (CWE-640). An unauthenticated attacker with network access to the application can brute-force password reset codes and take over user accounts. The CVSS base score is 9.1 (critical), with high impact on confidentiality and integrity. No public proof of concept or known exploitation has been reported so far.
Affected
- AKIN Software MyRezzta from 2.06.03 before 2.07.01 (per CVE record)
- Versions outside this range are not listed as affected in the CVE record
Fixed in
- Upgrade to MyRezzta 2.07.01 or later
Workaround
- The CVE record documents no vendor workaround.
- Third-party suggestion, not vendor-confirmed: restrict access to the application from untrusted networks, especially the password recovery function.
- Log and monitor repeated password reset requests until patched.
Exploitation
- Known exploited: no (CISA KEV not listed per sources).
- Public proof of concept: none found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS score is low (0.00232).
- Attack requires no authentication and no user interaction.
Our recommendation
- Identify whether MyRezzta is in use and which build is running.
- Patch to version 2.07.01 or later.
- Until patched, check whether the application and its password recovery endpoint are reachable from the internet and restrict access if not needed.
- Monitor for unusual password reset traffic and review accounts for unexpected changes.
- Read the TR-CERT advisory tr-26-1274 to confirm the affected range and fix. Re-check NVD and KEV status in the coming weeks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TR-CERT advisory tr-26-1274 siberguvenlik.gov.tr
- Ionix threat center: CVE-2026-19218 www.ionix.io
- VulDB 415345 vuldb.com
- Vulners: CVE-2026-19218 vulners.com
- HOL Guard: CVE-2026-19218 hol.org
- Strix: CVE-2026-19218 www.strix.ai
- CIRCL: earlier MyRezzta advisory (GHSA-67x8-m7gg-j4w3) vulnerability.circl.lu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:13.
Original description (NVD)
Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.