An unauthenticated attacker can perform unauthorized password resets on arbitrary accounts in MobiAPParc by exploiting improper validation of the user_id parameter.

This vulnerability is a weak password recovery mechanism (CWE-640) where the application fails to validate the user_id parameter during password reset requests. Because the identifier is predictable and lacks verification of ownership, any unauthenticated user can trigger a password change for any account.

The ability for an unauthenticated attacker to reset passwords for arbitrary users poses a severe threat to data confidentiality and account integrity. With a CVSS score of 8.8, this flaw facilitates full account takeover, which can lead to unauthorized access to sensitive user data, identity theft, and significant reputational damage to the organization.

Immediate Action: Update the MobiAPParc application to the latest version provided by the SMAP team to incorporate the necessary validation logic.

Proactive Monitoring: Review application access logs for an unusual spike in password reset requests or sequential attempts to access account identifiers.

Compensating Controls: Implement rate limiting on the password reset endpoint to mitigate automated brute-force or enumeration attempts against the user_id parameter.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the High severity of this vulnerability and the potential for total account compromise, administrators must prioritize this update. Ensure that all instances of MobiAPParc are patched to the latest version provided by the vendor to prevent unauthorized access and protect user credentials from exploitation.