Allegra Password Recovery Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in Allegra versions 8 prior to 8.1.24 and versions 7 prior to 7.5.2.70. This vulnerability arises from the password recovery mechanism, which relies on predictable values for generating password reset tokens. As a result, remote attackers can exploit this flaw to bypass authentication, potentially gaining unauthorized access to user accounts, including those of administrators.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including administrative accounts, by bypassing authentication through the password recovery mechanism.

Remediation

Allegra has released a patch for this vulnerability. Users can refer to the Allegra release notes for version 8.1.4 and 7.5.2.70 for more information on the update.