A critical authentication bypass vulnerability in Team Password Manager allows unauthenticated remote attackers to reset local account passwords and gain full unauthorized access to the application.

This vulnerability, classified as CWE-640, arises from a failure to enforce authentication requirements during the local account password reset process. An unauthenticated attacker can interact with the password reset flow to hijack any local account.

The ability for an unauthenticated attacker to reset passwords for any local user presents a severe risk of total system compromise. Given the product function as a password manager, successful exploitation could lead to the exposure of sensitive credentials, unauthorized access to managed systems, and significant reputational damage. The CVSS score of 9.1 reflects the extreme severity and ease of exploitation for this flaw.

Immediate Action: Update Team Password Manager to version 14.184.308 or later immediately to enforce proper authentication checks on the password reset endpoint.

Proactive Monitoring: Review web server and application access logs for unusual patterns involving the password reset functionality or unexpected account logins.

Compensating Controls: Implement strict network access controls to restrict access to the password reset interface to authorized IP addresses only until the patch is applied.

Public Exploit Available: No (exploit_available: false)

Due to the critical severity of this authentication bypass and the nature of the software as a credential repository, immediate patching is mandatory. Organizations should prioritize updating to version 14.184.308 or higher to eliminate the risk of unauthorized account takeover and potential data exfiltration.