Roadcube API Password Reset Vulnerability Allowing Arbitrary Code Execution

A vulnerability in the Roadcube API version 1 allows remote attackers to execute arbitrary code by exploiting a password reset endpoint that inadequately verifies the identity of the requester. The endpoint accepts a mobile phone number as the only input for triggering a password reset, lacking additional verification measures such as one-time codes or user interaction. This flaw enables attackers to reset passwords and gain full control over user accounts.

Impact

Exploitation of this vulnerability could lead to unauthorized account access, allowing attackers to take over user accounts and potentially misuse them.