CVE-2026-24467 is a critical (CVSS 9.0) account takeover flaw in the OpenAEV password reset. Tokens never expire and are only 8 digits, which makes guessing practical. Versions 1.0.0 up to but not including 2.0.13 are affected. Upgrade to 2.0.13 or later.
What's affected
The advisory says OpenAEV from 1.0.0 and before 2.0.13 is affected, and 2.0.13 is the fixed version. OpenAEV is an open source platform for planning and running cyber adversary simulation campaigns.
The record describes two weaknesses that combine. First, password reset tokens do not expire, even when newer ones are issued for the same account. Second, tokens are only 8 digits long. Eight digits is acceptable on its own, but when tokens never expire, an attacker can collect many valid ones, and each one shrinks the guessing space.
The CVSS vector has high attack complexity and a changed scope.
How to check if you're exposed
Find the OpenAEV version you run. For container deployments, look at the image tag. For source installs, check the release you checked out.
docker ps --format '{{.Image}}' | grep -i openaev
Anything from 1.0.0 to before 2.0.13 is in range. Review your access logs for large numbers of password reset requests, especially from a single source.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade OpenAEV to 2.0.13 or later.
- Reset passwords for accounts that may have been targeted, and review admin accounts first.
- Rate limit the password reset and login endpoints at your reverse proxy.
- Do not expose the platform to the internet if it only serves a security team.
- Review the access logs for bursts of reset requests.
Why it matters
The weakness is CWE-640, weak password recovery mechanism for a forgotten password. A reset token is a temporary password, so it needs a short life, a single use and enough randomness. Here the token lived forever and stacked up, which turned a strong enough number space into a weak one.
It matters more because the product holds attack simulation data and often has privileged integrations. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Password reset is a login path
Teams harden the login form and forget that the reset flow is a second way to get in. A reset token is a password that works once, for a short time. This flaw shows what happens when it is neither.
Two properties matter. A token must expire, usually within minutes or an hour, and it must be single use, so that a newer token replaces older ones. Here, tokens stayed valid forever and older ones kept working after new ones were issued. The advisory then explains why that matters even though eight digits sounds like plenty: an attacker who collects thousands of valid tokens only has to hit any one of them, so the work of guessing drops from a hundred million tries to tens of thousands.
What a sound design looks like
Use long random tokens, not short numbers, and store only a hash on the server. Expire them quickly, invalidate the previous token whenever a new one is created, and invalidate the token after use. Limit how many resets can be requested per account and per source. Tell the account owner by email when a reset happens.
What to check after the upgrade
Review the access logs for runs of reset requests, particularly many requests for one account, and for accounts whose passwords changed without the owner asking. Reset the passwords of administrators if you cannot rule out misuse. Enforce multi-factor authentication if the platform supports it, since a stolen password then no longer opens the door alone.
Where this platform sits
OpenAEV holds adversary simulation plans, which describe weak points in an organization. It deserves the same access limits as other security tooling: not open to the whole internet, and used by named people.
If you run other self-hosted tools, test the reset flow of each in a staging copy. A short checklist of expiry, single use, rate limiting and notification catches this class early.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does the number of valid tokens matter?
The more valid tokens exist for an account, the fewer guesses are needed to hit one, so tokens that never expire make guessing far easier.
Which version fixes it?
OpenAEV 2.0.13, according to the advisory.
Sources
Last reviewed: 19 October 2026.
