Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

• ECOSYSTEM: introduced 0; fixed 2025.4.6

## Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled `resetPasswordUrl`. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim clicks the link in their email, the token is sent to the attacker's server. The attacker then uses `POST /pimcore-studio/api/login/token` to authenticate as the victim with full admin privileges. Token login explicitly disables two-factor authentication, so even accounts with TOTP/Google Authenticator are compromised. ## Vulnerability Details ### Unauthenticated Endpoint Accepts Attacker URL The reset password endpoint at `src/User/Controller/ResetPasswordController.php` line 53 is public (uses `PUBLIC_STUDIO_API` voter). The `ResetPassword` schema at `src/User/Schema/ResetPassword.php` accepts a `resetPasswordUrl` string as a required parameter with zero validation. No URL scheme check, no domain allowlist, no comparison against the configured system domain. ```php final readonly class ResetPassword { public function __construct( private string $username, pri

GitHub Advisory Database via OSV

• ECOSYSTEM: introduced 2026.1.0; fixed 2026.1.6

## Summary An unauthenticated attacker takes over any Pimcore admin account by sending a password reset request with an attacker-controlled `resetPasswordUrl`. The server generates a real cryptographic recovery token, appends it to the attacker's URL, and emails the link to the victim. When the victim clicks the link in their email, the token is sent to the attacker's server. The attacker then uses `POST /pimcore-studio/api/login/token` to authenticate as the victim with full admin privileges. Token login explicitly disables two-factor authentication, so even accounts with TOTP/Google Authenticator are compromised. ## Vulnerability Details ### Unauthenticated Endpoint Accepts Attacker URL The reset password endpoint at `src/User/Controller/ResetPasswordController.php` line 53 is public (uses `PUBLIC_STUDIO_API` voter). The `ResetPassword` schema at `src/User/Schema/ResetPassword.php` accepts a `resetPasswordUrl` string as a required parameter with zero validation. No URL scheme check, no domain allowlist, no comparison against the configured system domain. ```php final readonly class ResetPassword { public function __construct( private string $username, pri

GitHub Advisory Database via OSV