Gladys Assistant versions prior to 5.1.0 are vulnerable to password reset link poisoning, which permits unauthenticated remote attackers to perform a full account takeover of any user, including administrators.

The application fails to perform server-side validation on the client-supplied origin parameter within the forgot_password endpoint, allowing unauthenticated attackers to poison password reset links and intercept sensitive tokens.

Successful exploitation leads to a complete account takeover, providing attackers with the same privileges as the compromised user. Given that this includes administrator accounts, the impact involves total loss of confidentiality and integrity, potentially allowing for system-wide configuration changes or data exfiltration. While the CVSS score is 6.8, the ability to compromise administrative accounts makes this a high-priority risk for all deployments.

Immediate Action: Upgrade to Gladys Assistant version 5.1.0 or later immediately to implement proper server-side validation of the reset link origin.

Proactive Monitoring: Review authentication logs and server access logs for anomalous requests directed at the forgot_password endpoint, specifically looking for unusual origin headers.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) rule to inspect and restrict the origin header values allowed during the password recovery process.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to organizational identity security by enabling unauthorized access to administrative functions. Organizations should prioritize the deployment of the 5.1.0 update to remediate the underlying flaw in the password reset mechanism. Failure to act leaves the environment susceptible to account hijacking that could facilitate further lateral movement or data compromise.