Q-Free MaxTime Password Reset Vulnerability Due to Missing Authentication

A vulnerability allowing password resets for arbitrary users has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from a missing authentication mechanism in the 'maxprofile/accounts/routes.lua' file, which enables unauthenticated remote attackers to exploit the vulnerability by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability allows an unauthenticated remote attacker to reset user passwords, potentially locking out legitimate users and gaining control over their accounts.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.