NamelessMC Password Reset Vulnerability Leading to Account Takeover

A vulnerability in NamelessMC versions through 2.1.2 allows for password resets and subsequent account takeovers. This issue arises when a user with 'admincp.core.emails' or 'admincp.users.edit' permissions manually validates another user. Unlike accounts validated via email, which receive a NULL reset code, manually validated accounts are assigned an empty reset code. An attacker can exploit this by requesting a password reset with the empty code, effectively taking over the account.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, leading to account takeovers.

Reproduction

To reproduce this vulnerability, register an account and have a user with 'admincp.core.emails' or 'admincp.users.edit' permissions validate it. Once validated, the attacker can send a password reset request with an empty code, allowing them to reset the password and take over the account.

Remediation

Users are advised to upgrade to NamelessMC version 2.1.3, where this vulnerability has been addressed.