GetSimple CMS CE: Predictable password reset allows administrator takeover
Summary
GetSimple CMS CE version 3.3.22 generates temporary passwords with PHP rand() seeded by microtime(), which leaves a small search space. The password reset endpoint can be triggered without authentication for an existing user, and the generated password is immediately set as the new password. The admin login has no rate limiting or account lockout, so an unauthenticated remote attacker can guess candidates online and take over the administrator account.
Affected
- GetSimple CMS CE 3.3.22
- Earlier versions: Unknown.
Fixed in
Unknown. No patch was publicly available at the time of publication.
Workaround
- Restrict access to /admin/ and the password reset endpoint to a VPN or IP allowlist.
- Apply web application firewall rules to the reset and login endpoints, as suggested by third parties; this is not a vendor fix.
- Enable MFA at the reverse proxy if possible.
Exploitation
- Pre-authentication and network-reachable; CVSS 3.1 9.1 (Critical).
- CISA SSVC lists exploitation as PoC and automatable: yes.
- Known exploited (KEV): no.
- Public PoC status is conflicting; treat as PoC may exist, unverified.
Our recommendation
- Check whether any installation runs version 3.3.22 and restrict its admin area immediately.
- Prioritise internet-facing sites with a guessable admin username.
- Apply the vendor fix once released and verify it against the GitHub advisory.
- Monitor for unexpected password reset requests and admin logins, and review admin accounts for unauthorised changes.
- Check CVE-2026-71542 (stored XSS in the admin interface) at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vvhx-56q2-gcjq github.com
- OSV: CVE-2026-53953 osv.dev
- VulDB: CVE-2026-53953 vuldb.com
- OpenCVE: CVE-2026-53953 app.opencve.io
- Vulners: CVE-2026-53953 vulners.com
- The Hacker Wire: CVE-2026-53953 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:44.
Original description (NVD)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated using PHP rand() seeded with microtime(). Because this seed is time-based and has a limited effective search space, an attacker can generate possible reset password candidates. Since the admin login endpoint does not enforce rate limiting or account lockout, these candidates can be tested online until the correct password is found. Successful exploitation may lead to administrator account takeover. At time of publication, there are no publicly available patches.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.